{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**扩展Jupyter访问阿里云日志服务**"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# 配置日志服务Jupyter扩展"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- 安装配置请参考：https://yq.aliyun.com/articles/689911"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [],
   "source": [
    "%reload_ext aliyun.log.ext.jupyter_magic"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "连接中...\n",
      "{\"errorCode\": \"Unauthorized\", \"errorMessage\": \"AccessKeyId not found: a\", \"requestId\": \"5C6E587ED289A85FE4A4B2F1\"}\n"
     ]
    }
   ],
   "source": [
    "%manage_log cn-hangzhou.log.aliyuncs.com a b dashboard-demo ddos-access-log"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "VBox(children=(ToggleButtons(options=('基本配置', '高级配置'), value='基本配置'), Text(value='cn-hangzhou.log.aliyuncs.com…"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "%manage_log"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# %log查询，默认过去15分钟"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "变量名：log_df\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "TransientProgressBar(value=0.0)"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/plain": [
       "InstancesProgress()"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/plain": [
       "DFViewWidget()"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>province</th>\n",
       "      <th>pv</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>-1</td>\n",
       "      <td>727</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>北京市</td>\n",
       "      <td>259</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>广东省</td>\n",
       "      <td>254</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>台湾省</td>\n",
       "      <td>160</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>重庆市</td>\n",
       "      <td>148</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>四川省</td>\n",
       "      <td>143</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>香港特别行政区</td>\n",
       "      <td>143</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>列宁格勒</td>\n",
       "      <td>136</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>贵州省</td>\n",
       "      <td>129</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>福建省</td>\n",
       "      <td>126</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>山东省</td>\n",
       "      <td>122</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>堪萨斯州</td>\n",
       "      <td>121</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td>KR_13</td>\n",
       "      <td>90</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>KR_05</td>\n",
       "      <td>39</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td>大雅加达</td>\n",
       "      <td>29</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>IN_07</td>\n",
       "      <td>19</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>16</th>\n",
       "      <td>BD_81</td>\n",
       "      <td>13</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>IN_10</td>\n",
       "      <td>12</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "   province   pv\n",
       "0        -1  727\n",
       "1       北京市  259\n",
       "2       广东省  254\n",
       "3       台湾省  160\n",
       "4       重庆市  148\n",
       "5       四川省  143\n",
       "6   香港特别行政区  143\n",
       "7      列宁格勒  136\n",
       "8       贵州省  129\n",
       "9       福建省  126\n",
       "10      山东省  122\n",
       "11     堪萨斯州  121\n",
       "12    KR_13   90\n",
       "13    KR_05   39\n",
       "14     大雅加达   29\n",
       "15    IN_07   19\n",
       "16    BD_81   13\n",
       "17    IN_10   12"
      ]
     },
     "execution_count": 4,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%log host: www.aa.mock-domain.com | select ip_to_province(real_client_ip) as province, count(1) as pv group by province order by pv desc\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "pandas.core.frame.DataFrame"
      ]
     },
     "execution_count": 15,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "type(log_df)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "<class 'pandas.core.frame.DataFrame'>\n",
      "RangeIndex: 18 entries, 0 to 17\n",
      "Data columns (total 2 columns):\n",
      "province    18 non-null object\n",
      "pv          18 non-null object\n",
      "dtypes: object(2)\n",
      "memory usage: 368.0+ bytes\n"
     ]
    }
   ],
   "source": [
    "log_df.info()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# %%log查询，配置时间"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "变量名：log_df\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "TransientProgressBar(value=0.0)"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/plain": [
       "InstancesProgress()"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/plain": [
       "DFViewWidget()"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>dt</th>\n",
       "      <th>pv</th>\n",
       "      <th>ratio</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>00:00</td>\n",
       "      <td>28</td>\n",
       "      <td>80.2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>01:00</td>\n",
       "      <td>78</td>\n",
       "      <td>80.2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>02:00</td>\n",
       "      <td>94</td>\n",
       "      <td>80.2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>03:00</td>\n",
       "      <td>44</td>\n",
       "      <td>80.3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>04:00</td>\n",
       "      <td>56</td>\n",
       "      <td>80.3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>05:00</td>\n",
       "      <td>0</td>\n",
       "      <td>80.2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>06:00</td>\n",
       "      <td>0</td>\n",
       "      <td>80.2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>07:00</td>\n",
       "      <td>58</td>\n",
       "      <td>80.3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>08:00</td>\n",
       "      <td>42</td>\n",
       "      <td>80.2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>09:00</td>\n",
       "      <td>0</td>\n",
       "      <td>80.2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>10:00</td>\n",
       "      <td>0</td>\n",
       "      <td>80.1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>11:00</td>\n",
       "      <td>0</td>\n",
       "      <td>80.2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td>12:00</td>\n",
       "      <td>58</td>\n",
       "      <td>80.2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>13:00</td>\n",
       "      <td>42</td>\n",
       "      <td>80.1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td>14:00</td>\n",
       "      <td>0</td>\n",
       "      <td>80.1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>15:00</td>\n",
       "      <td>0</td>\n",
       "      <td>80.2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>16</th>\n",
       "      <td>15:00</td>\n",
       "      <td>58</td>\n",
       "      <td>80.3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>16:00</td>\n",
       "      <td>89</td>\n",
       "      <td>80.2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>18</th>\n",
       "      <td>17:00</td>\n",
       "      <td>9</td>\n",
       "      <td>80.2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>19</th>\n",
       "      <td>18:00</td>\n",
       "      <td>7</td>\n",
       "      <td>80.2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20</th>\n",
       "      <td>19:00</td>\n",
       "      <td>95</td>\n",
       "      <td>80.1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>21</th>\n",
       "      <td>20:00</td>\n",
       "      <td>0</td>\n",
       "      <td>80.2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>22</th>\n",
       "      <td>21:00</td>\n",
       "      <td>3</td>\n",
       "      <td>80.1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>23</th>\n",
       "      <td>22:00</td>\n",
       "      <td>97</td>\n",
       "      <td>80.2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>24</th>\n",
       "      <td>23:00</td>\n",
       "      <td>0</td>\n",
       "      <td>80.3</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "       dt  pv ratio\n",
       "0   00:00  28  80.2\n",
       "1   01:00  78  80.2\n",
       "2   02:00  94  80.2\n",
       "3   03:00  44  80.3\n",
       "4   04:00  56  80.3\n",
       "5   05:00   0  80.2\n",
       "6   06:00   0  80.2\n",
       "7   07:00  58  80.3\n",
       "8   08:00  42  80.2\n",
       "9   09:00   0  80.2\n",
       "10  10:00   0  80.1\n",
       "11  11:00   0  80.2\n",
       "12  12:00  58  80.2\n",
       "13  13:00  42  80.1\n",
       "14  14:00   0  80.1\n",
       "15  15:00   0  80.2\n",
       "16  15:00  58  80.3\n",
       "17  16:00  89  80.2\n",
       "18  17:00   9  80.2\n",
       "19  18:00   7  80.2\n",
       "20  19:00  95  80.1\n",
       "21  20:00   0  80.2\n",
       "22  21:00   3  80.1\n",
       "23  22:00  97  80.2\n",
       "24  23:00   0  80.3"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%log -1day ~ now\n",
    "* | \n",
    "select date_format(date_trunc('hour', __time__), '%H:%i') as dt,  \n",
    "        count(1)%100 as pv, \n",
    "        round(sum(if(status < 400, 1, 0))*100.0/count(1), 1) AS ratio\n",
    "        group by date_trunc('hour', __time__) \n",
    "        order by dt limit 1000"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {
    "collapsed": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "变量名：log_df\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "TransientProgressBar(value=0.0)"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/plain": [
       "InstancesProgress()"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/plain": [
       "DFViewWidget()"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>__time__</th>\n",
       "      <th>__source__</th>\n",
       "      <th>__topic__</th>\n",
       "      <th>body_bytes_sent</th>\n",
       "      <th>cc_action</th>\n",
       "      <th>cc_blocks</th>\n",
       "      <th>cc_phase</th>\n",
       "      <th>content_type</th>\n",
       "      <th>host</th>\n",
       "      <th>http_cookie</th>\n",
       "      <th>...</th>\n",
       "      <th>ua_browser_type</th>\n",
       "      <th>ua_browser_version</th>\n",
       "      <th>ua_device_type</th>\n",
       "      <th>ua_os</th>\n",
       "      <th>ua_os_family</th>\n",
       "      <th>upstream_addr</th>\n",
       "      <th>upstream_ip</th>\n",
       "      <th>upstream_response_time</th>\n",
       "      <th>upstream_status</th>\n",
       "      <th>user_id</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>2019-02-21 15:18:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>6688</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/jgp</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>a1=y1;i2=t2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>118.120.156.13:80</td>\n",
       "      <td>110.120.151.20</td>\n",
       "      <td>0.555</td>\n",
       "      <td>200</td>\n",
       "      <td>mqyz7undl</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>2019-02-21 15:18:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>6974</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>text/xml</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>e1=z1;k2=m2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows_7</td>\n",
       "      <td></td>\n",
       "      <td>116.120.151.2:80</td>\n",
       "      <td>103.120.150.17</td>\n",
       "      <td>0.231</td>\n",
       "      <td>200</td>\n",
       "      <td>dmpdl77</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>2019-02-21 15:18:01</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>4437</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>text/xml</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>u1=b1;e2=r2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>9.0</td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td>windows</td>\n",
       "      <td>102.120.150.4:80</td>\n",
       "      <td>118.120.154.5</td>\n",
       "      <td>0.666</td>\n",
       "      <td>404</td>\n",
       "      <td>ufqkjn0zb4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>2019-02-21 15:18:01</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>5658</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/jgp</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>p1=w1;g2=j2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>ios</td>\n",
       "      <td>111.120.160.18:80</td>\n",
       "      <td>104.120.154.0</td>\n",
       "      <td>0.435</td>\n",
       "      <td>300</td>\n",
       "      <td>plqgxff959</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>2019-02-21 15:18:01</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>7467</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/png</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>f1=j1;o2=c2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows_7</td>\n",
       "      <td></td>\n",
       "      <td>103.120.152.9:80</td>\n",
       "      <td>113.120.156.9</td>\n",
       "      <td>0.503</td>\n",
       "      <td>300</td>\n",
       "      <td>2wq0cd</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>2019-02-21 15:18:01</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>8420</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td>static_whitelist</td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>p1=i1;x2=l2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>10</td>\n",
       "      <td>computer</td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td></td>\n",
       "      <td>102.120.153.0:80</td>\n",
       "      <td>120.120.154.10</td>\n",
       "      <td>0.043</td>\n",
       "      <td>200</td>\n",
       "      <td>2ndrkx</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>2019-02-21 15:18:02</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>3181</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/html</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>k1=z1;i2=l2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>9.0</td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td>windows</td>\n",
       "      <td>112.120.159.1:80</td>\n",
       "      <td>116.120.155.12</td>\n",
       "      <td>0.841</td>\n",
       "      <td>200</td>\n",
       "      <td>j86q75s</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>2019-02-21 15:18:02</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>237</td>\n",
       "      <td>pass</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/x-flv</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>r1=r1;p2=g2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>9.0</td>\n",
       "      <td></td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td>windows</td>\n",
       "      <td>118.120.156.11:80</td>\n",
       "      <td>118.120.160.9</td>\n",
       "      <td>0.049</td>\n",
       "      <td>200</td>\n",
       "      <td>05yr5g6dx</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>2019-02-21 15:18:02</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>4095</td>\n",
       "      <td>pass</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/jgp</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>q1=d1;o2=w2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>10</td>\n",
       "      <td>unknown</td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td>ios</td>\n",
       "      <td>102.120.160.4:80</td>\n",
       "      <td>120.120.151.5</td>\n",
       "      <td>0.469</td>\n",
       "      <td>200</td>\n",
       "      <td>cp61aq</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>2019-02-21 15:18:02</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>665</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>r1=p1;y2=z2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>114.120.155.13:80</td>\n",
       "      <td>104.120.154.7</td>\n",
       "      <td>0.595</td>\n",
       "      <td>200</td>\n",
       "      <td>p862l1fu92</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>2019-02-21 15:18:03</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>6966</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/xml</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>g1=d1;q2=t2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows_7</td>\n",
       "      <td></td>\n",
       "      <td>105.120.154.4:80</td>\n",
       "      <td>120.120.159.0</td>\n",
       "      <td>0.596</td>\n",
       "      <td>200</td>\n",
       "      <td>b2m6erfn</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>2019-02-21 15:18:03</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>9656</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>h1=v1;a2=r2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td>9.0</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>117.120.160.0:80</td>\n",
       "      <td>105.120.154.16</td>\n",
       "      <td>0.692</td>\n",
       "      <td>300</td>\n",
       "      <td>wdbqumiq4r</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td>2019-02-21 15:18:03</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>6334</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td>static_whitelist</td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>s1=z1;p2=h2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>115.120.154.16:80</td>\n",
       "      <td>109.120.154.0</td>\n",
       "      <td>0.297</td>\n",
       "      <td>300</td>\n",
       "      <td>0k7w3wdpem</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>2019-02-21 15:18:03</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>8058</td>\n",
       "      <td>captcha</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>l1=q1;t2=e2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows</td>\n",
       "      <td>114.120.155.13:80</td>\n",
       "      <td>106.120.155.8</td>\n",
       "      <td>0.79</td>\n",
       "      <td>200</td>\n",
       "      <td>bs9g0jmcm</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td>2019-02-21 15:18:04</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>345</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>l1=h1;l2=o2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>10</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>112.120.150.6:80</td>\n",
       "      <td>111.120.157.10</td>\n",
       "      <td>0.558</td>\n",
       "      <td>200</td>\n",
       "      <td>uovzh99</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>2019-02-21 15:18:04</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>5381</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>v1=b1;t2=u2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td>windows</td>\n",
       "      <td>108.120.153.2:80</td>\n",
       "      <td>102.120.153.18</td>\n",
       "      <td>0.623</td>\n",
       "      <td>300</td>\n",
       "      <td>9y3xwk8dg2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>16</th>\n",
       "      <td>2019-02-21 15:18:05</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>1582</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>i1=b1;h2=z2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td>unknown</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>113.120.160.19:80</td>\n",
       "      <td>109.120.160.4</td>\n",
       "      <td>0.009</td>\n",
       "      <td>502</td>\n",
       "      <td>z0jn7s5t</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>2019-02-21 15:18:05</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>2905</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>b1=a1;o2=j2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td>windows</td>\n",
       "      <td>115.120.150.1:80</td>\n",
       "      <td>109.120.152.5</td>\n",
       "      <td>0.696</td>\n",
       "      <td>200</td>\n",
       "      <td>o8frj0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>18</th>\n",
       "      <td>2019-02-21 15:18:05</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>3959</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>text/x-flv</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>p1=o1;b2=c2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>computer</td>\n",
       "      <td>windows_7</td>\n",
       "      <td></td>\n",
       "      <td>120.120.158.0:80</td>\n",
       "      <td>111.120.158.0</td>\n",
       "      <td>0.381</td>\n",
       "      <td>200</td>\n",
       "      <td>7z1s1x0q</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>19</th>\n",
       "      <td>2019-02-21 15:18:06</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>4152</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td>static_whitelist</td>\n",
       "      <td>text/xml</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>i1=r1;p2=q2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>9.0</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>106.120.151.17:80</td>\n",
       "      <td>111.120.154.18</td>\n",
       "      <td>0.565</td>\n",
       "      <td>200</td>\n",
       "      <td>xgmuduhu</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20</th>\n",
       "      <td>2019-02-21 15:18:06</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>2649</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td>server_ip_blacklist</td>\n",
       "      <td>text/xml</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>m1=n1;z2=w2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>104.120.150.16:80</td>\n",
       "      <td>110.120.151.5</td>\n",
       "      <td>0.641</td>\n",
       "      <td>200</td>\n",
       "      <td>dldgmaf</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>21</th>\n",
       "      <td>2019-02-21 15:18:07</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>3912</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/jgp</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>g1=r1;t2=t2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td>unknown</td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td>windows</td>\n",
       "      <td>109.120.156.12:80</td>\n",
       "      <td>108.120.154.18</td>\n",
       "      <td>0.907</td>\n",
       "      <td>200</td>\n",
       "      <td>aio34plm</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>22</th>\n",
       "      <td>2019-02-21 15:18:07</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>6681</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>o1=i1;u2=k2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>112.120.159.17:80</td>\n",
       "      <td>118.120.157.4</td>\n",
       "      <td>0.154</td>\n",
       "      <td>300</td>\n",
       "      <td>qf06n02gha</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>23</th>\n",
       "      <td>2019-02-21 15:18:07</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>5238</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/png</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>w1=s1;z2=k2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>114.120.158.16:80</td>\n",
       "      <td>117.120.153.3</td>\n",
       "      <td>0.159</td>\n",
       "      <td>200</td>\n",
       "      <td>bxh5rln8wr</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>24</th>\n",
       "      <td>2019-02-21 15:18:08</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>3301</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/png</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>p1=x1;u2=m2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td>10</td>\n",
       "      <td></td>\n",
       "      <td>windows_7</td>\n",
       "      <td>windows</td>\n",
       "      <td>107.120.154.2:80</td>\n",
       "      <td>104.120.150.19</td>\n",
       "      <td>0.668</td>\n",
       "      <td>200</td>\n",
       "      <td>mbjuhy</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25</th>\n",
       "      <td>2019-02-21 15:18:08</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>1083</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>g1=f1;g2=s2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td>9.0</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>107.120.151.15:80</td>\n",
       "      <td>109.120.156.14</td>\n",
       "      <td>0.524</td>\n",
       "      <td>200</td>\n",
       "      <td>afz02l5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>26</th>\n",
       "      <td>2019-02-21 15:18:08</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>2817</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/xml</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>t1=o1;x2=g2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>unknown</td>\n",
       "      <td>windows_7</td>\n",
       "      <td>windows</td>\n",
       "      <td>116.120.156.3:80</td>\n",
       "      <td>106.120.160.0</td>\n",
       "      <td>0.756</td>\n",
       "      <td>200</td>\n",
       "      <td>zxy720yr1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>27</th>\n",
       "      <td>2019-02-21 15:18:08</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>4066</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td>static_whitelist</td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>h1=y1;y2=i2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td></td>\n",
       "      <td>unknown</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>117.120.157.1:80</td>\n",
       "      <td>114.120.154.19</td>\n",
       "      <td>0.43</td>\n",
       "      <td>200</td>\n",
       "      <td>y0lejqzo</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>28</th>\n",
       "      <td>2019-02-21 15:18:08</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>9634</td>\n",
       "      <td>captcha</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>f1=p1;l2=l2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td>9.0</td>\n",
       "      <td>unknown</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>106.120.158.5:80</td>\n",
       "      <td>104.120.160.3</td>\n",
       "      <td>0.844</td>\n",
       "      <td>200</td>\n",
       "      <td>h4q6lab7b</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>29</th>\n",
       "      <td>2019-02-21 15:18:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>3434</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>i1=u1;w2=d2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>117.120.155.8:80</td>\n",
       "      <td>106.120.158.3</td>\n",
       "      <td>0.27</td>\n",
       "      <td>300</td>\n",
       "      <td>hw8yypu2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2657</th>\n",
       "      <td>2019-02-21 15:32:51</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>9407</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/html</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>x1=u1;l2=h2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td>9.0</td>\n",
       "      <td>computer</td>\n",
       "      <td>windows_7</td>\n",
       "      <td></td>\n",
       "      <td>103.120.153.4:80</td>\n",
       "      <td>113.120.154.8</td>\n",
       "      <td>0.38</td>\n",
       "      <td>200</td>\n",
       "      <td>32ay0d59wz</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2658</th>\n",
       "      <td>2019-02-21 15:32:52</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>6291</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/jgp</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>w1=f1;t2=f2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows</td>\n",
       "      <td>106.120.158.15:80</td>\n",
       "      <td>116.120.157.8</td>\n",
       "      <td>0.735</td>\n",
       "      <td>400</td>\n",
       "      <td>ldudfx05qg</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2659</th>\n",
       "      <td>2019-02-21 15:32:52</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>5587</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/xml</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>l1=p1;y2=e2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>115.120.153.0:80</td>\n",
       "      <td>113.120.154.4</td>\n",
       "      <td>0.007</td>\n",
       "      <td>200</td>\n",
       "      <td>14mypcr</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2660</th>\n",
       "      <td>2019-02-21 15:32:52</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>7901</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td>server_ip_blacklist</td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>m1=z1;d2=p2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td>9.0</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>109.120.155.4:80</td>\n",
       "      <td>110.120.151.19</td>\n",
       "      <td>0.028</td>\n",
       "      <td>200</td>\n",
       "      <td>2yzz1m</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2661</th>\n",
       "      <td>2019-02-21 15:32:53</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>1268</td>\n",
       "      <td>close</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>t1=s1;w2=m2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>111.120.155.18:80</td>\n",
       "      <td>113.120.158.0</td>\n",
       "      <td>0.591</td>\n",
       "      <td>200</td>\n",
       "      <td>iv058lt</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2662</th>\n",
       "      <td>2019-02-21 15:32:53</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>9177</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>i1=h1;n2=l2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td>9.0</td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td>ios</td>\n",
       "      <td>105.120.154.18:80</td>\n",
       "      <td>115.120.150.1</td>\n",
       "      <td>0.02</td>\n",
       "      <td>400</td>\n",
       "      <td>mw7hlyq</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2663</th>\n",
       "      <td>2019-02-21 15:32:53</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>975</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>s1=m1;g2=e2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td>9.0</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>ios</td>\n",
       "      <td>101.120.157.0:80</td>\n",
       "      <td>102.120.158.16</td>\n",
       "      <td>0.771</td>\n",
       "      <td>200</td>\n",
       "      <td>w0xyaiq</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2664</th>\n",
       "      <td>2019-02-21 15:32:53</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>9546</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>o1=i1;g2=t2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td>10</td>\n",
       "      <td>computer</td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td></td>\n",
       "      <td>117.120.155.9:80</td>\n",
       "      <td>117.120.154.16</td>\n",
       "      <td>0.8</td>\n",
       "      <td>404</td>\n",
       "      <td>h6xnn1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2665</th>\n",
       "      <td>2019-02-21 15:32:54</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>5282</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>n1=i1;q2=p2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>114.120.158.2:80</td>\n",
       "      <td>114.120.151.5</td>\n",
       "      <td>0.917</td>\n",
       "      <td>300</td>\n",
       "      <td>k9i2nay</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2666</th>\n",
       "      <td>2019-02-21 15:32:54</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>4195</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td>server_ip_blacklist</td>\n",
       "      <td>image/jgp</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>t1=j1;j2=x2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows_7</td>\n",
       "      <td>windows</td>\n",
       "      <td>114.120.157.9:80</td>\n",
       "      <td>105.120.156.4</td>\n",
       "      <td>0.184</td>\n",
       "      <td>200</td>\n",
       "      <td>ut3lpl04vh</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2667</th>\n",
       "      <td>2019-02-21 15:32:54</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>8064</td>\n",
       "      <td>challenge</td>\n",
       "      <td>1</td>\n",
       "      <td>server_ip_blacklist</td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>z1=k1;k2=z2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>108.120.152.4:80</td>\n",
       "      <td>101.120.159.10</td>\n",
       "      <td>0.436</td>\n",
       "      <td>200</td>\n",
       "      <td>922wbsd</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2668</th>\n",
       "      <td>2019-02-21 15:32:55</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>2085</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>text/html</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>b1=h1;g2=l2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>10</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>114.120.150.4:80</td>\n",
       "      <td>117.120.152.20</td>\n",
       "      <td>0.099</td>\n",
       "      <td>200</td>\n",
       "      <td>i8tddbtav1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2669</th>\n",
       "      <td>2019-02-21 15:32:55</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>153</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td>static_whitelist</td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>s1=t1;m2=m2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>110.120.154.13:80</td>\n",
       "      <td>112.120.158.19</td>\n",
       "      <td>0.708</td>\n",
       "      <td>400</td>\n",
       "      <td>h5fzks</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2670</th>\n",
       "      <td>2019-02-21 15:32:55</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>1697</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>d1=t1;g2=z2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>10</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>ios</td>\n",
       "      <td>111.120.151.20:80</td>\n",
       "      <td>116.120.160.10</td>\n",
       "      <td>0.443</td>\n",
       "      <td>200</td>\n",
       "      <td>xu4v08ifr0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2671</th>\n",
       "      <td>2019-02-21 15:32:55</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>7140</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>b1=k1;k2=p2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td>9.0</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>112.120.158.8:80</td>\n",
       "      <td>117.120.159.0</td>\n",
       "      <td>0.719</td>\n",
       "      <td>200</td>\n",
       "      <td>wp0yp5m</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2672</th>\n",
       "      <td>2019-02-21 15:32:55</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>9295</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/html</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>h1=w1;g2=i2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td>10</td>\n",
       "      <td>computer</td>\n",
       "      <td>windows_7</td>\n",
       "      <td></td>\n",
       "      <td>106.120.158.16:80</td>\n",
       "      <td>101.120.154.8</td>\n",
       "      <td>0.461</td>\n",
       "      <td>300</td>\n",
       "      <td>pptwxyacj</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2673</th>\n",
       "      <td>2019-02-21 15:32:55</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>8630</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>p1=q1;l2=b2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>105.120.152.1:80</td>\n",
       "      <td>105.120.159.10</td>\n",
       "      <td>0.299</td>\n",
       "      <td>300</td>\n",
       "      <td>uscigrfr</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2674</th>\n",
       "      <td>2019-02-21 15:32:56</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>3082</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/png</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>u1=l1;s2=j2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>ios</td>\n",
       "      <td>120.120.153.6:80</td>\n",
       "      <td>101.120.160.16</td>\n",
       "      <td>0.389</td>\n",
       "      <td>300</td>\n",
       "      <td>suhyge</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2675</th>\n",
       "      <td>2019-02-21 15:32:56</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>6269</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>w1=x1;w2=s2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>9.0</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>103.120.159.20:80</td>\n",
       "      <td>102.120.152.16</td>\n",
       "      <td>0.642</td>\n",
       "      <td>300</td>\n",
       "      <td>8t1syt</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2676</th>\n",
       "      <td>2019-02-21 15:32:56</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>511</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td>static_whitelist</td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>g1=q1;k2=w2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>112.120.150.18:80</td>\n",
       "      <td>106.120.153.18</td>\n",
       "      <td>0.469</td>\n",
       "      <td>200</td>\n",
       "      <td>t57ftr14pe</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2677</th>\n",
       "      <td>2019-02-21 15:32:56</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>5392</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>o1=f1;b2=r2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td>10</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>119.120.159.5:80</td>\n",
       "      <td>113.120.154.0</td>\n",
       "      <td>0.377</td>\n",
       "      <td>400</td>\n",
       "      <td>1kb20t</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2678</th>\n",
       "      <td>2019-02-21 15:32:56</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>684</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>z1=m1;j2=h2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td>9.0</td>\n",
       "      <td>unknown</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>108.120.159.18:80</td>\n",
       "      <td>108.120.156.19</td>\n",
       "      <td>0.605</td>\n",
       "      <td>200</td>\n",
       "      <td>whmwv7e5l</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2679</th>\n",
       "      <td>2019-02-21 15:32:56</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>4596</td>\n",
       "      <td>close</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/x-flv</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>b1=m1;e2=d2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows</td>\n",
       "      <td>114.120.154.4:80</td>\n",
       "      <td>106.120.155.2</td>\n",
       "      <td>0.472</td>\n",
       "      <td>200</td>\n",
       "      <td>sls8mona</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2680</th>\n",
       "      <td>2019-02-21 15:32:56</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>8893</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/html</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>v1=p1;p2=k2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows</td>\n",
       "      <td>102.120.155.19:80</td>\n",
       "      <td>115.120.153.8</td>\n",
       "      <td>0.601</td>\n",
       "      <td>200</td>\n",
       "      <td>fvbzog13r</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2681</th>\n",
       "      <td>2019-02-21 15:32:57</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>8986</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>s1=q1;f2=w2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td>10</td>\n",
       "      <td></td>\n",
       "      <td>windows_7</td>\n",
       "      <td>windows</td>\n",
       "      <td>114.120.152.20:80</td>\n",
       "      <td>109.120.156.17</td>\n",
       "      <td>0.31</td>\n",
       "      <td>200</td>\n",
       "      <td>f47py1xu</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2682</th>\n",
       "      <td>2019-02-21 15:32:57</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>794</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td>seccookie</td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>e1=m1;t2=n2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td>windows</td>\n",
       "      <td>104.120.156.8:80</td>\n",
       "      <td>104.120.156.6</td>\n",
       "      <td>0.611</td>\n",
       "      <td>200</td>\n",
       "      <td>d7277920</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2683</th>\n",
       "      <td>2019-02-21 15:32:58</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>4278</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/xml</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>j1=c1;f2=v2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td>windows</td>\n",
       "      <td>119.120.160.7:80</td>\n",
       "      <td>107.120.159.7</td>\n",
       "      <td>0.89</td>\n",
       "      <td>200</td>\n",
       "      <td>a255j0e9</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2684</th>\n",
       "      <td>2019-02-21 15:32:59</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>3518</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/png</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>z1=a1;o2=q2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td></td>\n",
       "      <td>119.120.157.4:80</td>\n",
       "      <td>116.120.155.16</td>\n",
       "      <td>0.315</td>\n",
       "      <td>404</td>\n",
       "      <td>bydo1d</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2685</th>\n",
       "      <td>2019-02-21 15:32:59</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>3298</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td>server_ip_blacklist</td>\n",
       "      <td>text/x-flv</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>b1=j1;w2=i2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td>9.0</td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>104.120.153.7:80</td>\n",
       "      <td>104.120.158.3</td>\n",
       "      <td>0.06</td>\n",
       "      <td>200</td>\n",
       "      <td>ulbm1idhm0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2686</th>\n",
       "      <td>2019-02-21 15:32:59</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>4354</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/jgp</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>m1=c1;v2=o2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td>ios</td>\n",
       "      <td>120.120.154.5:80</td>\n",
       "      <td>102.120.157.0</td>\n",
       "      <td>0.045</td>\n",
       "      <td>200</td>\n",
       "      <td>m3nyea</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>2687 rows × 39 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                    __source__        __topic__ body_bytes_sent  cc_action  \\\n",
       "__time__                                                                     \n",
       "2019-02-21 15:18:00    1.2.3.4  ddos_access_log            6688       none   \n",
       "2019-02-21 15:18:00    1.2.3.4  ddos_access_log            6974       none   \n",
       "2019-02-21 15:18:01    1.2.3.4  ddos_access_log            4437       none   \n",
       "2019-02-21 15:18:01    1.2.3.4  ddos_access_log            5658       none   \n",
       "2019-02-21 15:18:01    1.2.3.4  ddos_access_log            7467       none   \n",
       "2019-02-21 15:18:01    1.2.3.4  ddos_access_log            8420       none   \n",
       "2019-02-21 15:18:02    1.2.3.4  ddos_access_log            3181       none   \n",
       "2019-02-21 15:18:02    1.2.3.4  ddos_access_log             237       pass   \n",
       "2019-02-21 15:18:02    1.2.3.4  ddos_access_log            4095       pass   \n",
       "2019-02-21 15:18:02    1.2.3.4  ddos_access_log             665       none   \n",
       "2019-02-21 15:18:03    1.2.3.4  ddos_access_log            6966       none   \n",
       "2019-02-21 15:18:03    1.2.3.4  ddos_access_log            9656       none   \n",
       "2019-02-21 15:18:03    1.2.3.4  ddos_access_log            6334       none   \n",
       "2019-02-21 15:18:03    1.2.3.4  ddos_access_log            8058    captcha   \n",
       "2019-02-21 15:18:04    1.2.3.4  ddos_access_log             345       none   \n",
       "2019-02-21 15:18:04    1.2.3.4  ddos_access_log            5381       none   \n",
       "2019-02-21 15:18:05    1.2.3.4  ddos_access_log            1582       none   \n",
       "2019-02-21 15:18:05    1.2.3.4  ddos_access_log            2905       none   \n",
       "2019-02-21 15:18:05    1.2.3.4  ddos_access_log            3959       none   \n",
       "2019-02-21 15:18:06    1.2.3.4  ddos_access_log            4152       none   \n",
       "2019-02-21 15:18:06    1.2.3.4  ddos_access_log            2649       none   \n",
       "2019-02-21 15:18:07    1.2.3.4  ddos_access_log            3912       none   \n",
       "2019-02-21 15:18:07    1.2.3.4  ddos_access_log            6681       none   \n",
       "2019-02-21 15:18:07    1.2.3.4  ddos_access_log            5238       none   \n",
       "2019-02-21 15:18:08    1.2.3.4  ddos_access_log            3301       none   \n",
       "2019-02-21 15:18:08    1.2.3.4  ddos_access_log            1083       none   \n",
       "2019-02-21 15:18:08    1.2.3.4  ddos_access_log            2817       none   \n",
       "2019-02-21 15:18:08    1.2.3.4  ddos_access_log            4066       none   \n",
       "2019-02-21 15:18:08    1.2.3.4  ddos_access_log            9634    captcha   \n",
       "2019-02-21 15:18:09    1.2.3.4  ddos_access_log            3434       none   \n",
       "...                        ...              ...             ...        ...   \n",
       "2019-02-21 15:32:51    1.2.3.4  ddos_access_log            9407       none   \n",
       "2019-02-21 15:32:52    1.2.3.4  ddos_access_log            6291       none   \n",
       "2019-02-21 15:32:52    1.2.3.4  ddos_access_log            5587       none   \n",
       "2019-02-21 15:32:52    1.2.3.4  ddos_access_log            7901       none   \n",
       "2019-02-21 15:32:53    1.2.3.4  ddos_access_log            1268      close   \n",
       "2019-02-21 15:32:53    1.2.3.4  ddos_access_log            9177       none   \n",
       "2019-02-21 15:32:53    1.2.3.4  ddos_access_log             975       none   \n",
       "2019-02-21 15:32:53    1.2.3.4  ddos_access_log            9546       none   \n",
       "2019-02-21 15:32:54    1.2.3.4  ddos_access_log            5282       none   \n",
       "2019-02-21 15:32:54    1.2.3.4  ddos_access_log            4195       none   \n",
       "2019-02-21 15:32:54    1.2.3.4  ddos_access_log            8064  challenge   \n",
       "2019-02-21 15:32:55    1.2.3.4  ddos_access_log            2085       none   \n",
       "2019-02-21 15:32:55    1.2.3.4  ddos_access_log             153       none   \n",
       "2019-02-21 15:32:55    1.2.3.4  ddos_access_log            1697       none   \n",
       "2019-02-21 15:32:55    1.2.3.4  ddos_access_log            7140       none   \n",
       "2019-02-21 15:32:55    1.2.3.4  ddos_access_log            9295       none   \n",
       "2019-02-21 15:32:55    1.2.3.4  ddos_access_log            8630       none   \n",
       "2019-02-21 15:32:56    1.2.3.4  ddos_access_log            3082       none   \n",
       "2019-02-21 15:32:56    1.2.3.4  ddos_access_log            6269       none   \n",
       "2019-02-21 15:32:56    1.2.3.4  ddos_access_log             511       none   \n",
       "2019-02-21 15:32:56    1.2.3.4  ddos_access_log            5392       none   \n",
       "2019-02-21 15:32:56    1.2.3.4  ddos_access_log             684       none   \n",
       "2019-02-21 15:32:56    1.2.3.4  ddos_access_log            4596      close   \n",
       "2019-02-21 15:32:56    1.2.3.4  ddos_access_log            8893       none   \n",
       "2019-02-21 15:32:57    1.2.3.4  ddos_access_log            8986       none   \n",
       "2019-02-21 15:32:57    1.2.3.4  ddos_access_log             794       none   \n",
       "2019-02-21 15:32:58    1.2.3.4  ddos_access_log            4278       none   \n",
       "2019-02-21 15:32:59    1.2.3.4  ddos_access_log            3518       none   \n",
       "2019-02-21 15:32:59    1.2.3.4  ddos_access_log            3298       none   \n",
       "2019-02-21 15:32:59    1.2.3.4  ddos_access_log            4354       none   \n",
       "\n",
       "                    cc_blocks             cc_phase content_type  \\\n",
       "__time__                                                          \n",
       "2019-02-21 15:18:00                                   image/jgp   \n",
       "2019-02-21 15:18:00         1                          text/xml   \n",
       "2019-02-21 15:18:01         1                          text/xml   \n",
       "2019-02-21 15:18:01                                   image/jgp   \n",
       "2019-02-21 15:18:01                                   image/png   \n",
       "2019-02-21 15:18:01               static_whitelist     text/avi   \n",
       "2019-02-21 15:18:02                                   text/html   \n",
       "2019-02-21 15:18:02                                  text/x-flv   \n",
       "2019-02-21 15:18:02                                   image/jgp   \n",
       "2019-02-21 15:18:02                                    text/avi   \n",
       "2019-02-21 15:18:03                                    text/xml   \n",
       "2019-02-21 15:18:03         1                          text/mp4   \n",
       "2019-02-21 15:18:03         1     static_whitelist     text/avi   \n",
       "2019-02-21 15:18:03         1                          text/avi   \n",
       "2019-02-21 15:18:04                                    text/mp4   \n",
       "2019-02-21 15:18:04                                    text/mp4   \n",
       "2019-02-21 15:18:05                                    text/mp4   \n",
       "2019-02-21 15:18:05         1                          text/avi   \n",
       "2019-02-21 15:18:05         1                        text/x-flv   \n",
       "2019-02-21 15:18:06         1     static_whitelist     text/xml   \n",
       "2019-02-21 15:18:06            server_ip_blacklist     text/xml   \n",
       "2019-02-21 15:18:07                                   image/jgp   \n",
       "2019-02-21 15:18:07                                    text/mp4   \n",
       "2019-02-21 15:18:07                                   image/png   \n",
       "2019-02-21 15:18:08                                   image/png   \n",
       "2019-02-21 15:18:08                                    text/avi   \n",
       "2019-02-21 15:18:08                                    text/xml   \n",
       "2019-02-21 15:18:08               static_whitelist     text/mp4   \n",
       "2019-02-21 15:18:08                                    text/mp4   \n",
       "2019-02-21 15:18:09                                    text/mp4   \n",
       "...                       ...                  ...          ...   \n",
       "2019-02-21 15:32:51                                   text/html   \n",
       "2019-02-21 15:32:52                                   image/jgp   \n",
       "2019-02-21 15:32:52                                    text/xml   \n",
       "2019-02-21 15:32:52         1  server_ip_blacklist     text/mp4   \n",
       "2019-02-21 15:32:53                                    text/avi   \n",
       "2019-02-21 15:32:53                                    text/avi   \n",
       "2019-02-21 15:32:53                                    text/avi   \n",
       "2019-02-21 15:32:53                                    text/avi   \n",
       "2019-02-21 15:32:54                                    text/mp4   \n",
       "2019-02-21 15:32:54            server_ip_blacklist    image/jgp   \n",
       "2019-02-21 15:32:54         1  server_ip_blacklist     text/mp4   \n",
       "2019-02-21 15:32:55         1                         text/html   \n",
       "2019-02-21 15:32:55               static_whitelist     text/mp4   \n",
       "2019-02-21 15:32:55         1                          text/mp4   \n",
       "2019-02-21 15:32:55                                    text/mp4   \n",
       "2019-02-21 15:32:55                                   text/html   \n",
       "2019-02-21 15:32:55                                    text/mp4   \n",
       "2019-02-21 15:32:56                                   image/png   \n",
       "2019-02-21 15:32:56                                    text/avi   \n",
       "2019-02-21 15:32:56               static_whitelist     text/avi   \n",
       "2019-02-21 15:32:56                                    text/avi   \n",
       "2019-02-21 15:32:56                                    text/avi   \n",
       "2019-02-21 15:32:56                                  text/x-flv   \n",
       "2019-02-21 15:32:56                                   text/html   \n",
       "2019-02-21 15:32:57         1                          text/mp4   \n",
       "2019-02-21 15:32:57                      seccookie     text/avi   \n",
       "2019-02-21 15:32:58                                    text/xml   \n",
       "2019-02-21 15:32:59                                   image/png   \n",
       "2019-02-21 15:32:59            server_ip_blacklist   text/x-flv   \n",
       "2019-02-21 15:32:59                                   image/jgp   \n",
       "\n",
       "                                       host  http_cookie  \\\n",
       "__time__                                                   \n",
       "2019-02-21 15:18:00  www.aa.mock-domain.com  a1=y1;i2=t2   \n",
       "2019-02-21 15:18:00  www.aa.mock-domain.com  e1=z1;k2=m2   \n",
       "2019-02-21 15:18:01  www.aa.mock-domain.com  u1=b1;e2=r2   \n",
       "2019-02-21 15:18:01  www.aa.mock-domain.com  p1=w1;g2=j2   \n",
       "2019-02-21 15:18:01  www.aa.mock-domain.com  f1=j1;o2=c2   \n",
       "2019-02-21 15:18:01  www.aa.mock-domain.com  p1=i1;x2=l2   \n",
       "2019-02-21 15:18:02  www.aa.mock-domain.com  k1=z1;i2=l2   \n",
       "2019-02-21 15:18:02  www.aa.mock-domain.com  r1=r1;p2=g2   \n",
       "2019-02-21 15:18:02  www.aa.mock-domain.com  q1=d1;o2=w2   \n",
       "2019-02-21 15:18:02  www.aa.mock-domain.com  r1=p1;y2=z2   \n",
       "2019-02-21 15:18:03  www.aa.mock-domain.com  g1=d1;q2=t2   \n",
       "2019-02-21 15:18:03  www.aa.mock-domain.com  h1=v1;a2=r2   \n",
       "2019-02-21 15:18:03  www.aa.mock-domain.com  s1=z1;p2=h2   \n",
       "2019-02-21 15:18:03  www.aa.mock-domain.com  l1=q1;t2=e2   \n",
       "2019-02-21 15:18:04  www.aa.mock-domain.com  l1=h1;l2=o2   \n",
       "2019-02-21 15:18:04  www.aa.mock-domain.com  v1=b1;t2=u2   \n",
       "2019-02-21 15:18:05  www.aa.mock-domain.com  i1=b1;h2=z2   \n",
       "2019-02-21 15:18:05  www.aa.mock-domain.com  b1=a1;o2=j2   \n",
       "2019-02-21 15:18:05  www.aa.mock-domain.com  p1=o1;b2=c2   \n",
       "2019-02-21 15:18:06  www.aa.mock-domain.com  i1=r1;p2=q2   \n",
       "2019-02-21 15:18:06  www.aa.mock-domain.com  m1=n1;z2=w2   \n",
       "2019-02-21 15:18:07  www.aa.mock-domain.com  g1=r1;t2=t2   \n",
       "2019-02-21 15:18:07  www.aa.mock-domain.com  o1=i1;u2=k2   \n",
       "2019-02-21 15:18:07  www.aa.mock-domain.com  w1=s1;z2=k2   \n",
       "2019-02-21 15:18:08  www.aa.mock-domain.com  p1=x1;u2=m2   \n",
       "2019-02-21 15:18:08  www.aa.mock-domain.com  g1=f1;g2=s2   \n",
       "2019-02-21 15:18:08  www.aa.mock-domain.com  t1=o1;x2=g2   \n",
       "2019-02-21 15:18:08  www.aa.mock-domain.com  h1=y1;y2=i2   \n",
       "2019-02-21 15:18:08  www.aa.mock-domain.com  f1=p1;l2=l2   \n",
       "2019-02-21 15:18:09  www.aa.mock-domain.com  i1=u1;w2=d2   \n",
       "...                                     ...          ...   \n",
       "2019-02-21 15:32:51  www.aa.mock-domain.com  x1=u1;l2=h2   \n",
       "2019-02-21 15:32:52  www.aa.mock-domain.com  w1=f1;t2=f2   \n",
       "2019-02-21 15:32:52  www.aa.mock-domain.com  l1=p1;y2=e2   \n",
       "2019-02-21 15:32:52  www.aa.mock-domain.com  m1=z1;d2=p2   \n",
       "2019-02-21 15:32:53  www.aa.mock-domain.com  t1=s1;w2=m2   \n",
       "2019-02-21 15:32:53  www.aa.mock-domain.com  i1=h1;n2=l2   \n",
       "2019-02-21 15:32:53  www.aa.mock-domain.com  s1=m1;g2=e2   \n",
       "2019-02-21 15:32:53  www.aa.mock-domain.com  o1=i1;g2=t2   \n",
       "2019-02-21 15:32:54  www.aa.mock-domain.com  n1=i1;q2=p2   \n",
       "2019-02-21 15:32:54  www.aa.mock-domain.com  t1=j1;j2=x2   \n",
       "2019-02-21 15:32:54  www.aa.mock-domain.com  z1=k1;k2=z2   \n",
       "2019-02-21 15:32:55  www.aa.mock-domain.com  b1=h1;g2=l2   \n",
       "2019-02-21 15:32:55  www.aa.mock-domain.com  s1=t1;m2=m2   \n",
       "2019-02-21 15:32:55  www.aa.mock-domain.com  d1=t1;g2=z2   \n",
       "2019-02-21 15:32:55  www.aa.mock-domain.com  b1=k1;k2=p2   \n",
       "2019-02-21 15:32:55  www.aa.mock-domain.com  h1=w1;g2=i2   \n",
       "2019-02-21 15:32:55  www.aa.mock-domain.com  p1=q1;l2=b2   \n",
       "2019-02-21 15:32:56  www.aa.mock-domain.com  u1=l1;s2=j2   \n",
       "2019-02-21 15:32:56  www.aa.mock-domain.com  w1=x1;w2=s2   \n",
       "2019-02-21 15:32:56  www.aa.mock-domain.com  g1=q1;k2=w2   \n",
       "2019-02-21 15:32:56  www.aa.mock-domain.com  o1=f1;b2=r2   \n",
       "2019-02-21 15:32:56  www.aa.mock-domain.com  z1=m1;j2=h2   \n",
       "2019-02-21 15:32:56  www.aa.mock-domain.com  b1=m1;e2=d2   \n",
       "2019-02-21 15:32:56  www.aa.mock-domain.com  v1=p1;p2=k2   \n",
       "2019-02-21 15:32:57  www.aa.mock-domain.com  s1=q1;f2=w2   \n",
       "2019-02-21 15:32:57  www.aa.mock-domain.com  e1=m1;t2=n2   \n",
       "2019-02-21 15:32:58  www.aa.mock-domain.com  j1=c1;f2=v2   \n",
       "2019-02-21 15:32:59  www.aa.mock-domain.com  z1=a1;o2=q2   \n",
       "2019-02-21 15:32:59  www.aa.mock-domain.com  b1=j1;w2=i2   \n",
       "2019-02-21 15:32:59  www.aa.mock-domain.com  m1=c1;v2=o2   \n",
       "\n",
       "                                       http_referer  ... ua_browser_type  \\\n",
       "__time__                                             ...                   \n",
       "2019-02-21 15:18:00  http://www.dda.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:00  http://www.ccd.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:01  http://www.dbd.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:01  http://www.aca.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:01  http://www.caa.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:01   http://www.bc.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:02  http://www.dbc.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:02   http://www.ba.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:02   http://www.cd.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:02  http://www.aad.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:18:03  http://www.abb.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:18:03  http://www.cab.mock-domain.com  ...           robot   \n",
       "2019-02-21 15:18:03  http://www.cdd.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:03   http://www.aa.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:04   http://www.ad.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:04  http://www.abd.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:05   http://www.ca.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:18:05  http://www.aab.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:05  http://www.dcb.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:06  http://www.cba.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:06   http://www.ab.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:07  http://www.bbd.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:18:07   http://www.bd.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:18:07   http://www.ac.mock-domain.com  ...           robot   \n",
       "2019-02-21 15:18:08  http://www.bdb.mock-domain.com  ...           robot   \n",
       "2019-02-21 15:18:08  http://www.bcb.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:18:08   http://www.db.mock-domain.com  ...                   \n",
       "2019-02-21 15:18:08   http://www.bc.mock-domain.com  ...           robot   \n",
       "2019-02-21 15:18:08  http://www.cbc.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:18:09  http://www.dbc.mock-domain.com  ...           robot   \n",
       "...                                             ...  ...             ...   \n",
       "2019-02-21 15:32:51   http://www.bc.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:32:52  http://www.bbc.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:32:52   http://www.ca.mock-domain.com  ...           robot   \n",
       "2019-02-21 15:32:52   http://www.db.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:32:53  http://www.aaa.mock-domain.com  ...                   \n",
       "2019-02-21 15:32:53   http://www.bb.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:32:53  http://www.ccd.mock-domain.com  ...           robot   \n",
       "2019-02-21 15:32:53   http://www.bc.mock-domain.com  ...           robot   \n",
       "2019-02-21 15:32:54   http://www.cb.mock-domain.com  ...                   \n",
       "2019-02-21 15:32:54   http://www.dc.mock-domain.com  ...                   \n",
       "2019-02-21 15:32:54   http://www.bb.mock-domain.com  ...                   \n",
       "2019-02-21 15:32:55  http://www.cdd.mock-domain.com  ...                   \n",
       "2019-02-21 15:32:55  http://www.dab.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:32:55   http://www.cb.mock-domain.com  ...                   \n",
       "2019-02-21 15:32:55  http://www.dda.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:32:55   http://www.cc.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:32:55   http://www.ab.mock-domain.com  ...                   \n",
       "2019-02-21 15:32:56   http://www.ac.mock-domain.com  ...                   \n",
       "2019-02-21 15:32:56   http://www.aa.mock-domain.com  ...                   \n",
       "2019-02-21 15:32:56  http://www.cad.mock-domain.com  ...                   \n",
       "2019-02-21 15:32:56   http://www.cb.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:32:56  http://www.aba.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:32:56   http://www.ad.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:32:56   http://www.bd.mock-domain.com  ...                   \n",
       "2019-02-21 15:32:57   http://www.ca.mock-domain.com  ...           robot   \n",
       "2019-02-21 15:32:57  http://www.cdd.mock-domain.com  ...                   \n",
       "2019-02-21 15:32:58  http://www.baa.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:32:59   http://www.bb.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:32:59   http://www.ac.mock-domain.com  ...     web_browser   \n",
       "2019-02-21 15:32:59  http://www.cbd.mock-domain.com  ...     web_browser   \n",
       "\n",
       "                    ua_browser_version ua_device_type          ua_os  \\\n",
       "__time__                                                               \n",
       "2019-02-21 15:18:00                                                    \n",
       "2019-02-21 15:18:00                                        windows_7   \n",
       "2019-02-21 15:18:01                9.0       computer                  \n",
       "2019-02-21 15:18:01                                                    \n",
       "2019-02-21 15:18:01                                        windows_7   \n",
       "2019-02-21 15:18:01                 10       computer  ios8_1_iphone   \n",
       "2019-02-21 15:18:02                9.0       computer                  \n",
       "2019-02-21 15:18:02                9.0                 ios8_1_iphone   \n",
       "2019-02-21 15:18:02                 10        unknown  ios8_1_iphone   \n",
       "2019-02-21 15:18:02                                                    \n",
       "2019-02-21 15:18:03                                        windows_7   \n",
       "2019-02-21 15:18:03                9.0                                 \n",
       "2019-02-21 15:18:03                                                    \n",
       "2019-02-21 15:18:03                                                    \n",
       "2019-02-21 15:18:04                 10                                 \n",
       "2019-02-21 15:18:04                          computer                  \n",
       "2019-02-21 15:18:05                           unknown                  \n",
       "2019-02-21 15:18:05                          computer                  \n",
       "2019-02-21 15:18:05                          computer      windows_7   \n",
       "2019-02-21 15:18:06                9.0                                 \n",
       "2019-02-21 15:18:06                          computer                  \n",
       "2019-02-21 15:18:07                           unknown  ios8_1_iphone   \n",
       "2019-02-21 15:18:07                                                    \n",
       "2019-02-21 15:18:07                                                    \n",
       "2019-02-21 15:18:08                 10                     windows_7   \n",
       "2019-02-21 15:18:08                9.0                                 \n",
       "2019-02-21 15:18:08                           unknown      windows_7   \n",
       "2019-02-21 15:18:08                           unknown                  \n",
       "2019-02-21 15:18:08                9.0        unknown                  \n",
       "2019-02-21 15:18:09                                                    \n",
       "...                                ...            ...            ...   \n",
       "2019-02-21 15:32:51                9.0       computer      windows_7   \n",
       "2019-02-21 15:32:52                                                    \n",
       "2019-02-21 15:32:52                                                    \n",
       "2019-02-21 15:32:52                9.0                                 \n",
       "2019-02-21 15:32:53                                                    \n",
       "2019-02-21 15:32:53                9.0       computer                  \n",
       "2019-02-21 15:32:53                9.0                                 \n",
       "2019-02-21 15:32:53                 10       computer  ios8_1_iphone   \n",
       "2019-02-21 15:32:54                                                    \n",
       "2019-02-21 15:32:54                                        windows_7   \n",
       "2019-02-21 15:32:54                          computer                  \n",
       "2019-02-21 15:32:55                 10                                 \n",
       "2019-02-21 15:32:55                          computer                  \n",
       "2019-02-21 15:32:55                 10                                 \n",
       "2019-02-21 15:32:55                9.0                                 \n",
       "2019-02-21 15:32:55                 10       computer      windows_7   \n",
       "2019-02-21 15:32:55                                                    \n",
       "2019-02-21 15:32:56                                                    \n",
       "2019-02-21 15:32:56                9.0                                 \n",
       "2019-02-21 15:32:56                                                    \n",
       "2019-02-21 15:32:56                 10                                 \n",
       "2019-02-21 15:32:56                9.0        unknown                  \n",
       "2019-02-21 15:32:56                                                    \n",
       "2019-02-21 15:32:56                                                    \n",
       "2019-02-21 15:32:57                 10                     windows_7   \n",
       "2019-02-21 15:32:57                          computer                  \n",
       "2019-02-21 15:32:58                                    ios8_1_iphone   \n",
       "2019-02-21 15:32:59                                    ios8_1_iphone   \n",
       "2019-02-21 15:32:59                9.0       computer                  \n",
       "2019-02-21 15:32:59                          computer                  \n",
       "\n",
       "                    ua_os_family      upstream_addr     upstream_ip  \\\n",
       "__time__                                                              \n",
       "2019-02-21 15:18:00               118.120.156.13:80  110.120.151.20   \n",
       "2019-02-21 15:18:00                116.120.151.2:80  103.120.150.17   \n",
       "2019-02-21 15:18:01      windows   102.120.150.4:80   118.120.154.5   \n",
       "2019-02-21 15:18:01          ios  111.120.160.18:80   104.120.154.0   \n",
       "2019-02-21 15:18:01                103.120.152.9:80   113.120.156.9   \n",
       "2019-02-21 15:18:01                102.120.153.0:80  120.120.154.10   \n",
       "2019-02-21 15:18:02      windows   112.120.159.1:80  116.120.155.12   \n",
       "2019-02-21 15:18:02      windows  118.120.156.11:80   118.120.160.9   \n",
       "2019-02-21 15:18:02          ios   102.120.160.4:80   120.120.151.5   \n",
       "2019-02-21 15:18:02               114.120.155.13:80   104.120.154.7   \n",
       "2019-02-21 15:18:03                105.120.154.4:80   120.120.159.0   \n",
       "2019-02-21 15:18:03                117.120.160.0:80  105.120.154.16   \n",
       "2019-02-21 15:18:03               115.120.154.16:80   109.120.154.0   \n",
       "2019-02-21 15:18:03      windows  114.120.155.13:80   106.120.155.8   \n",
       "2019-02-21 15:18:04                112.120.150.6:80  111.120.157.10   \n",
       "2019-02-21 15:18:04      windows   108.120.153.2:80  102.120.153.18   \n",
       "2019-02-21 15:18:05               113.120.160.19:80   109.120.160.4   \n",
       "2019-02-21 15:18:05      windows   115.120.150.1:80   109.120.152.5   \n",
       "2019-02-21 15:18:05                120.120.158.0:80   111.120.158.0   \n",
       "2019-02-21 15:18:06               106.120.151.17:80  111.120.154.18   \n",
       "2019-02-21 15:18:06               104.120.150.16:80   110.120.151.5   \n",
       "2019-02-21 15:18:07      windows  109.120.156.12:80  108.120.154.18   \n",
       "2019-02-21 15:18:07               112.120.159.17:80   118.120.157.4   \n",
       "2019-02-21 15:18:07               114.120.158.16:80   117.120.153.3   \n",
       "2019-02-21 15:18:08      windows   107.120.154.2:80  104.120.150.19   \n",
       "2019-02-21 15:18:08               107.120.151.15:80  109.120.156.14   \n",
       "2019-02-21 15:18:08      windows   116.120.156.3:80   106.120.160.0   \n",
       "2019-02-21 15:18:08                117.120.157.1:80  114.120.154.19   \n",
       "2019-02-21 15:18:08                106.120.158.5:80   104.120.160.3   \n",
       "2019-02-21 15:18:09                117.120.155.8:80   106.120.158.3   \n",
       "...                          ...                ...             ...   \n",
       "2019-02-21 15:32:51                103.120.153.4:80   113.120.154.8   \n",
       "2019-02-21 15:32:52      windows  106.120.158.15:80   116.120.157.8   \n",
       "2019-02-21 15:32:52                115.120.153.0:80   113.120.154.4   \n",
       "2019-02-21 15:32:52                109.120.155.4:80  110.120.151.19   \n",
       "2019-02-21 15:32:53               111.120.155.18:80   113.120.158.0   \n",
       "2019-02-21 15:32:53          ios  105.120.154.18:80   115.120.150.1   \n",
       "2019-02-21 15:32:53          ios   101.120.157.0:80  102.120.158.16   \n",
       "2019-02-21 15:32:53                117.120.155.9:80  117.120.154.16   \n",
       "2019-02-21 15:32:54                114.120.158.2:80   114.120.151.5   \n",
       "2019-02-21 15:32:54      windows   114.120.157.9:80   105.120.156.4   \n",
       "2019-02-21 15:32:54                108.120.152.4:80  101.120.159.10   \n",
       "2019-02-21 15:32:55                114.120.150.4:80  117.120.152.20   \n",
       "2019-02-21 15:32:55               110.120.154.13:80  112.120.158.19   \n",
       "2019-02-21 15:32:55          ios  111.120.151.20:80  116.120.160.10   \n",
       "2019-02-21 15:32:55                112.120.158.8:80   117.120.159.0   \n",
       "2019-02-21 15:32:55               106.120.158.16:80   101.120.154.8   \n",
       "2019-02-21 15:32:55                105.120.152.1:80  105.120.159.10   \n",
       "2019-02-21 15:32:56          ios   120.120.153.6:80  101.120.160.16   \n",
       "2019-02-21 15:32:56               103.120.159.20:80  102.120.152.16   \n",
       "2019-02-21 15:32:56               112.120.150.18:80  106.120.153.18   \n",
       "2019-02-21 15:32:56                119.120.159.5:80   113.120.154.0   \n",
       "2019-02-21 15:32:56               108.120.159.18:80  108.120.156.19   \n",
       "2019-02-21 15:32:56      windows   114.120.154.4:80   106.120.155.2   \n",
       "2019-02-21 15:32:56      windows  102.120.155.19:80   115.120.153.8   \n",
       "2019-02-21 15:32:57      windows  114.120.152.20:80  109.120.156.17   \n",
       "2019-02-21 15:32:57      windows   104.120.156.8:80   104.120.156.6   \n",
       "2019-02-21 15:32:58      windows   119.120.160.7:80   107.120.159.7   \n",
       "2019-02-21 15:32:59                119.120.157.4:80  116.120.155.16   \n",
       "2019-02-21 15:32:59                104.120.153.7:80   104.120.158.3   \n",
       "2019-02-21 15:32:59          ios   120.120.154.5:80   102.120.157.0   \n",
       "\n",
       "                    upstream_response_time upstream_status     user_id  \n",
       "__time__                                                                \n",
       "2019-02-21 15:18:00                  0.555             200   mqyz7undl  \n",
       "2019-02-21 15:18:00                  0.231             200     dmpdl77  \n",
       "2019-02-21 15:18:01                  0.666             404  ufqkjn0zb4  \n",
       "2019-02-21 15:18:01                  0.435             300  plqgxff959  \n",
       "2019-02-21 15:18:01                  0.503             300      2wq0cd  \n",
       "2019-02-21 15:18:01                  0.043             200      2ndrkx  \n",
       "2019-02-21 15:18:02                  0.841             200     j86q75s  \n",
       "2019-02-21 15:18:02                  0.049             200   05yr5g6dx  \n",
       "2019-02-21 15:18:02                  0.469             200      cp61aq  \n",
       "2019-02-21 15:18:02                  0.595             200  p862l1fu92  \n",
       "2019-02-21 15:18:03                  0.596             200    b2m6erfn  \n",
       "2019-02-21 15:18:03                  0.692             300  wdbqumiq4r  \n",
       "2019-02-21 15:18:03                  0.297             300  0k7w3wdpem  \n",
       "2019-02-21 15:18:03                   0.79             200   bs9g0jmcm  \n",
       "2019-02-21 15:18:04                  0.558             200     uovzh99  \n",
       "2019-02-21 15:18:04                  0.623             300  9y3xwk8dg2  \n",
       "2019-02-21 15:18:05                  0.009             502    z0jn7s5t  \n",
       "2019-02-21 15:18:05                  0.696             200      o8frj0  \n",
       "2019-02-21 15:18:05                  0.381             200    7z1s1x0q  \n",
       "2019-02-21 15:18:06                  0.565             200    xgmuduhu  \n",
       "2019-02-21 15:18:06                  0.641             200     dldgmaf  \n",
       "2019-02-21 15:18:07                  0.907             200    aio34plm  \n",
       "2019-02-21 15:18:07                  0.154             300  qf06n02gha  \n",
       "2019-02-21 15:18:07                  0.159             200  bxh5rln8wr  \n",
       "2019-02-21 15:18:08                  0.668             200      mbjuhy  \n",
       "2019-02-21 15:18:08                  0.524             200     afz02l5  \n",
       "2019-02-21 15:18:08                  0.756             200   zxy720yr1  \n",
       "2019-02-21 15:18:08                   0.43             200    y0lejqzo  \n",
       "2019-02-21 15:18:08                  0.844             200   h4q6lab7b  \n",
       "2019-02-21 15:18:09                   0.27             300    hw8yypu2  \n",
       "...                                    ...             ...         ...  \n",
       "2019-02-21 15:32:51                   0.38             200  32ay0d59wz  \n",
       "2019-02-21 15:32:52                  0.735             400  ldudfx05qg  \n",
       "2019-02-21 15:32:52                  0.007             200     14mypcr  \n",
       "2019-02-21 15:32:52                  0.028             200      2yzz1m  \n",
       "2019-02-21 15:32:53                  0.591             200     iv058lt  \n",
       "2019-02-21 15:32:53                   0.02             400     mw7hlyq  \n",
       "2019-02-21 15:32:53                  0.771             200     w0xyaiq  \n",
       "2019-02-21 15:32:53                    0.8             404      h6xnn1  \n",
       "2019-02-21 15:32:54                  0.917             300     k9i2nay  \n",
       "2019-02-21 15:32:54                  0.184             200  ut3lpl04vh  \n",
       "2019-02-21 15:32:54                  0.436             200     922wbsd  \n",
       "2019-02-21 15:32:55                  0.099             200  i8tddbtav1  \n",
       "2019-02-21 15:32:55                  0.708             400      h5fzks  \n",
       "2019-02-21 15:32:55                  0.443             200  xu4v08ifr0  \n",
       "2019-02-21 15:32:55                  0.719             200     wp0yp5m  \n",
       "2019-02-21 15:32:55                  0.461             300   pptwxyacj  \n",
       "2019-02-21 15:32:55                  0.299             300    uscigrfr  \n",
       "2019-02-21 15:32:56                  0.389             300      suhyge  \n",
       "2019-02-21 15:32:56                  0.642             300      8t1syt  \n",
       "2019-02-21 15:32:56                  0.469             200  t57ftr14pe  \n",
       "2019-02-21 15:32:56                  0.377             400      1kb20t  \n",
       "2019-02-21 15:32:56                  0.605             200   whmwv7e5l  \n",
       "2019-02-21 15:32:56                  0.472             200    sls8mona  \n",
       "2019-02-21 15:32:56                  0.601             200   fvbzog13r  \n",
       "2019-02-21 15:32:57                   0.31             200    f47py1xu  \n",
       "2019-02-21 15:32:57                  0.611             200    d7277920  \n",
       "2019-02-21 15:32:58                   0.89             200    a255j0e9  \n",
       "2019-02-21 15:32:59                  0.315             404      bydo1d  \n",
       "2019-02-21 15:32:59                   0.06             200  ulbm1idhm0  \n",
       "2019-02-21 15:32:59                  0.045             200      m3nyea  \n",
       "\n",
       "[2687 rows x 38 columns]"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%log host: www.aa.mock-domain.com"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# %fetch全量拉取"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "变量名：log_df\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "TransientProgressBar(value=0.0)"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/plain": [
       "InstancesProgress()"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/plain": [
       "DFViewWidget()"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>__time__</th>\n",
       "      <th>__source__</th>\n",
       "      <th>__topic__</th>\n",
       "      <th>body_bytes_sent</th>\n",
       "      <th>cc_action</th>\n",
       "      <th>cc_blocks</th>\n",
       "      <th>cc_phase</th>\n",
       "      <th>content_type</th>\n",
       "      <th>host</th>\n",
       "      <th>http_cookie</th>\n",
       "      <th>...</th>\n",
       "      <th>ua_browser_type</th>\n",
       "      <th>ua_browser_version</th>\n",
       "      <th>ua_device_type</th>\n",
       "      <th>ua_os</th>\n",
       "      <th>ua_os_family</th>\n",
       "      <th>upstream_addr</th>\n",
       "      <th>upstream_ip</th>\n",
       "      <th>upstream_response_time</th>\n",
       "      <th>upstream_status</th>\n",
       "      <th>user_id</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>4222</td>\n",
       "      <td>close</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.ccd.mock-domain.com</td>\n",
       "      <td>y1=g1;g2=c2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>10</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>107.120.155.19:80</td>\n",
       "      <td>113.120.159.6</td>\n",
       "      <td>0.828</td>\n",
       "      <td>400</td>\n",
       "      <td>5opgoe</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>5564</td>\n",
       "      <td>close</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.dad.mock-domain.com</td>\n",
       "      <td>q1=x1;r2=q2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td>10</td>\n",
       "      <td></td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td></td>\n",
       "      <td>115.120.153.9:80</td>\n",
       "      <td>112.120.154.13</td>\n",
       "      <td>0.892</td>\n",
       "      <td>200</td>\n",
       "      <td>lxoyf6emz3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>8562</td>\n",
       "      <td>captcha</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/png</td>\n",
       "      <td>www.bac.mock-domain.com</td>\n",
       "      <td>f1=x1;o2=j2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td>computer</td>\n",
       "      <td>windows_7</td>\n",
       "      <td>windows</td>\n",
       "      <td>115.120.159.1:80</td>\n",
       "      <td>114.120.155.16</td>\n",
       "      <td>0.365</td>\n",
       "      <td>200</td>\n",
       "      <td>7t22id6</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>462</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/xml</td>\n",
       "      <td>www.cd.mock-domain.com</td>\n",
       "      <td>g1=x1;b2=y2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td>10</td>\n",
       "      <td>computer</td>\n",
       "      <td>windows_7</td>\n",
       "      <td>windows</td>\n",
       "      <td>116.120.158.5:80</td>\n",
       "      <td>111.120.160.0</td>\n",
       "      <td>0.729</td>\n",
       "      <td>300</td>\n",
       "      <td>5m2qqov2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>4817</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/png</td>\n",
       "      <td>www.db.mock-domain.com</td>\n",
       "      <td>k1=n1;e2=q2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows_7</td>\n",
       "      <td>windows</td>\n",
       "      <td>118.120.153.13:80</td>\n",
       "      <td>111.120.157.1</td>\n",
       "      <td>0.473</td>\n",
       "      <td>200</td>\n",
       "      <td>7bkyz4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>2318</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td>static_whitelist</td>\n",
       "      <td>image/png</td>\n",
       "      <td>www.ba.mock-domain.com</td>\n",
       "      <td>u1=h1;j2=t2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>10</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows</td>\n",
       "      <td>104.120.160.16:80</td>\n",
       "      <td>114.120.157.13</td>\n",
       "      <td>0.282</td>\n",
       "      <td>300</td>\n",
       "      <td>8bml4hthq8</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>105</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aba.mock-domain.com</td>\n",
       "      <td>s1=t1;h2=a2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>unknown</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>115.120.156.3:80</td>\n",
       "      <td>111.120.160.3</td>\n",
       "      <td>0.301</td>\n",
       "      <td>200</td>\n",
       "      <td>0g9p0ddk8</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>4500</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>image/jgp</td>\n",
       "      <td>www.bbb.mock-domain.com</td>\n",
       "      <td>g1=p1;z2=y2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td>ios</td>\n",
       "      <td>105.120.151.10:80</td>\n",
       "      <td>106.120.157.4</td>\n",
       "      <td>0.638</td>\n",
       "      <td>502</td>\n",
       "      <td>x8porfk</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>7435</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.bbb.mock-domain.com</td>\n",
       "      <td>p1=n1;t2=o2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>10</td>\n",
       "      <td>unknown</td>\n",
       "      <td>windows_7</td>\n",
       "      <td>windows</td>\n",
       "      <td>107.120.153.2:80</td>\n",
       "      <td>103.120.150.14</td>\n",
       "      <td>0.844</td>\n",
       "      <td>200</td>\n",
       "      <td>ygpjcc</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>2407</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/jgp</td>\n",
       "      <td>www.bdd.mock-domain.com</td>\n",
       "      <td>l1=p1;h2=j2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>101.120.155.10:80</td>\n",
       "      <td>110.120.154.8</td>\n",
       "      <td>0.472</td>\n",
       "      <td>300</td>\n",
       "      <td>v9wbv1i</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>4071</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "      <td>n1=x1;z2=e2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>117.120.156.5:80</td>\n",
       "      <td>117.120.154.2</td>\n",
       "      <td>0.234</td>\n",
       "      <td>200</td>\n",
       "      <td>hxvt75hk</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>730</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.bb.mock-domain.com</td>\n",
       "      <td>f1=w1;x2=b2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows_7</td>\n",
       "      <td></td>\n",
       "      <td>111.120.157.20:80</td>\n",
       "      <td>108.120.152.12</td>\n",
       "      <td>0.795</td>\n",
       "      <td>400</td>\n",
       "      <td>a8fo6uzl0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>2700</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.aad.mock-domain.com</td>\n",
       "      <td>i1=s1;d2=y2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td>9.0</td>\n",
       "      <td>unknown</td>\n",
       "      <td></td>\n",
       "      <td>windows</td>\n",
       "      <td>104.120.155.13:80</td>\n",
       "      <td>101.120.159.7</td>\n",
       "      <td>0.709</td>\n",
       "      <td>200</td>\n",
       "      <td>7mso25k</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>8227</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.db.mock-domain.com</td>\n",
       "      <td>k1=y1;e2=t2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>118.120.160.2:80</td>\n",
       "      <td>107.120.158.7</td>\n",
       "      <td>0.716</td>\n",
       "      <td>300</td>\n",
       "      <td>an5nfpek</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>9538</td>\n",
       "      <td>close</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/xml</td>\n",
       "      <td>www.dd.mock-domain.com</td>\n",
       "      <td>b1=n1;e2=u2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>107.120.158.6:80</td>\n",
       "      <td>106.120.151.5</td>\n",
       "      <td>0.502</td>\n",
       "      <td>200</td>\n",
       "      <td>pgks8vv3iz</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>9591</td>\n",
       "      <td>close</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/xml</td>\n",
       "      <td>www.db.mock-domain.com</td>\n",
       "      <td>m1=r1;k2=g2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td></td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td>windows</td>\n",
       "      <td>116.120.150.8:80</td>\n",
       "      <td>105.120.160.11</td>\n",
       "      <td>0.814</td>\n",
       "      <td>200</td>\n",
       "      <td>7oi74sqm</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>16</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>5215</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td>server_ip_blacklist</td>\n",
       "      <td>text/x-flv</td>\n",
       "      <td>www.bdd.mock-domain.com</td>\n",
       "      <td>d1=v1;w2=r2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td>9.0</td>\n",
       "      <td></td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td>windows</td>\n",
       "      <td>101.120.157.2:80</td>\n",
       "      <td>107.120.153.3</td>\n",
       "      <td>0.68</td>\n",
       "      <td>300</td>\n",
       "      <td>3xbz71hprc</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>1063</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/jgp</td>\n",
       "      <td>www.cbd.mock-domain.com</td>\n",
       "      <td>g1=y1;h2=m2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>107.120.154.18:80</td>\n",
       "      <td>114.120.150.20</td>\n",
       "      <td>0.257</td>\n",
       "      <td>200</td>\n",
       "      <td>8kr662</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>18</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>8276</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/xml</td>\n",
       "      <td>www.bb.mock-domain.com</td>\n",
       "      <td>x1=i1;q2=z2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>9.0</td>\n",
       "      <td>computer</td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td></td>\n",
       "      <td>109.120.160.8:80</td>\n",
       "      <td>120.120.152.5</td>\n",
       "      <td>0.133</td>\n",
       "      <td>400</td>\n",
       "      <td>xexgb82p1f</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>19</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>5290</td>\n",
       "      <td>challenge</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.bad.mock-domain.com</td>\n",
       "      <td>q1=n1;e2=u2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td>ios</td>\n",
       "      <td>106.120.152.1:80</td>\n",
       "      <td>117.120.159.5</td>\n",
       "      <td>0.56</td>\n",
       "      <td>200</td>\n",
       "      <td>d6k6sfa</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>1815</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>text/x-flv</td>\n",
       "      <td>www.dcb.mock-domain.com</td>\n",
       "      <td>q1=e1;w2=f2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>111.120.160.1:80</td>\n",
       "      <td>104.120.152.0</td>\n",
       "      <td>0.91</td>\n",
       "      <td>200</td>\n",
       "      <td>1ec92q9f</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>21</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>3688</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/jgp</td>\n",
       "      <td>www.dc.mock-domain.com</td>\n",
       "      <td>u1=x1;h2=t2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td>10</td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td>windows</td>\n",
       "      <td>117.120.160.2:80</td>\n",
       "      <td>109.120.153.12</td>\n",
       "      <td>0.868</td>\n",
       "      <td>200</td>\n",
       "      <td>8e9ohrt</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>22</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>2173</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>image/png</td>\n",
       "      <td>www.cc.mock-domain.com</td>\n",
       "      <td>c1=j1;s2=q2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>115.120.151.18:80</td>\n",
       "      <td>113.120.160.3</td>\n",
       "      <td>0.376</td>\n",
       "      <td>200</td>\n",
       "      <td>387egb</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>23</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>6972</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.dcc.mock-domain.com</td>\n",
       "      <td>p1=p1;o2=o2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>10</td>\n",
       "      <td>unknown</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>117.120.155.3:80</td>\n",
       "      <td>115.120.153.18</td>\n",
       "      <td>0.921</td>\n",
       "      <td>200</td>\n",
       "      <td>mmm8xeh7e0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>24</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>484</td>\n",
       "      <td>captcha</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.cb.mock-domain.com</td>\n",
       "      <td>w1=q1;m2=e2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>9.0</td>\n",
       "      <td>unknown</td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td></td>\n",
       "      <td>116.120.158.17:80</td>\n",
       "      <td>110.120.158.15</td>\n",
       "      <td>0.724</td>\n",
       "      <td>200</td>\n",
       "      <td>2emhs0wkp</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>3713</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/png</td>\n",
       "      <td>www.aac.mock-domain.com</td>\n",
       "      <td>u1=j1;l2=j2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>105.120.158.5:80</td>\n",
       "      <td>120.120.157.16</td>\n",
       "      <td>0.758</td>\n",
       "      <td>300</td>\n",
       "      <td>eei5rxwww</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>26</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>9900</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td>static_whitelist</td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.cab.mock-domain.com</td>\n",
       "      <td>z1=m1;i2=q2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>9.0</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>118.120.154.19:80</td>\n",
       "      <td>116.120.151.4</td>\n",
       "      <td>0.128</td>\n",
       "      <td>200</td>\n",
       "      <td>ayx9p14j</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>27</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>2154</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td>static_whitelist</td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.bad.mock-domain.com</td>\n",
       "      <td>u1=q1;p2=s2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows</td>\n",
       "      <td>102.120.157.9:80</td>\n",
       "      <td>110.120.150.18</td>\n",
       "      <td>0.452</td>\n",
       "      <td>300</td>\n",
       "      <td>mnnyrt54h9</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>28</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>1768</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td>static_whitelist</td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.dbc.mock-domain.com</td>\n",
       "      <td>b1=g1;k2=f2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows_7</td>\n",
       "      <td>ios</td>\n",
       "      <td>113.120.160.12:80</td>\n",
       "      <td>108.120.160.8</td>\n",
       "      <td>0.395</td>\n",
       "      <td>502</td>\n",
       "      <td>kghxx7z6o</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>29</th>\n",
       "      <td>2019-01-31 10:00:00</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>9948</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/x-flv</td>\n",
       "      <td>www.bc.mock-domain.com</td>\n",
       "      <td>g1=p1;n2=b2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td>computer</td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td>windows</td>\n",
       "      <td>107.120.150.15:80</td>\n",
       "      <td>118.120.160.4</td>\n",
       "      <td>0.784</td>\n",
       "      <td>300</td>\n",
       "      <td>ftsf8tsfmg</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>970</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>9471</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.cbb.mock-domain.com</td>\n",
       "      <td>p1=f1;j2=t2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>9.0</td>\n",
       "      <td>unknown</td>\n",
       "      <td></td>\n",
       "      <td>windows</td>\n",
       "      <td>111.120.152.5:80</td>\n",
       "      <td>113.120.154.12</td>\n",
       "      <td>0.756</td>\n",
       "      <td>499</td>\n",
       "      <td>1qe240h5n0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>971</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>5260</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/png</td>\n",
       "      <td>www.da.mock-domain.com</td>\n",
       "      <td>x1=g1;l2=j2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td></td>\n",
       "      <td>111.120.150.18:80</td>\n",
       "      <td>113.120.153.6</td>\n",
       "      <td>0.897</td>\n",
       "      <td>200</td>\n",
       "      <td>5vwife4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>972</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>9396</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.da.mock-domain.com</td>\n",
       "      <td>w1=t1;y2=l2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td></td>\n",
       "      <td>104.120.157.17:80</td>\n",
       "      <td>117.120.155.17</td>\n",
       "      <td>0.511</td>\n",
       "      <td>200</td>\n",
       "      <td>47dftd</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>973</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>1192</td>\n",
       "      <td>pass</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/jgp</td>\n",
       "      <td>www.cac.mock-domain.com</td>\n",
       "      <td>t1=q1;p2=t2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>9.0</td>\n",
       "      <td></td>\n",
       "      <td>windows_7</td>\n",
       "      <td>windows</td>\n",
       "      <td>105.120.156.7:80</td>\n",
       "      <td>117.120.160.3</td>\n",
       "      <td>0.985</td>\n",
       "      <td>200</td>\n",
       "      <td>fy3k0x7yca</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>974</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>7307</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>text/html</td>\n",
       "      <td>www.cd.mock-domain.com</td>\n",
       "      <td>x1=u1;x2=i2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td>9.0</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>112.120.156.5:80</td>\n",
       "      <td>101.120.159.5</td>\n",
       "      <td>0.412</td>\n",
       "      <td>404</td>\n",
       "      <td>6utx9s</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>975</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>5186</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>text/x-flv</td>\n",
       "      <td>www.db.mock-domain.com</td>\n",
       "      <td>s1=z1;v2=y2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td>9.0</td>\n",
       "      <td></td>\n",
       "      <td>windows_7</td>\n",
       "      <td>ios</td>\n",
       "      <td>116.120.159.11:80</td>\n",
       "      <td>119.120.160.12</td>\n",
       "      <td>0.387</td>\n",
       "      <td>300</td>\n",
       "      <td>jy1m24di29</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>976</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>6430</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td>seccookie</td>\n",
       "      <td>text/html</td>\n",
       "      <td>www.cc.mock-domain.com</td>\n",
       "      <td>l1=f1;t2=w2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>10</td>\n",
       "      <td>unknown</td>\n",
       "      <td>windows_7</td>\n",
       "      <td>ios</td>\n",
       "      <td>118.120.152.2:80</td>\n",
       "      <td>118.120.157.10</td>\n",
       "      <td>0.544</td>\n",
       "      <td>200</td>\n",
       "      <td>7014zrk</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>977</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>4472</td>\n",
       "      <td>captcha</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.da.mock-domain.com</td>\n",
       "      <td>n1=u1;i2=l2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>10</td>\n",
       "      <td>unknown</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>108.120.160.14:80</td>\n",
       "      <td>103.120.156.1</td>\n",
       "      <td>0.691</td>\n",
       "      <td>404</td>\n",
       "      <td>tvzs4fr</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>978</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>8031</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.acd.mock-domain.com</td>\n",
       "      <td>e1=y1;y2=w2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>114.120.150.1:80</td>\n",
       "      <td>117.120.160.19</td>\n",
       "      <td>0.37</td>\n",
       "      <td>300</td>\n",
       "      <td>5k5vhfut41</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>979</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>3674</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td>static_whitelist</td>\n",
       "      <td>image/jgp</td>\n",
       "      <td>www.da.mock-domain.com</td>\n",
       "      <td>s1=p1;w2=q2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>10</td>\n",
       "      <td>computer</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>101.120.153.16:80</td>\n",
       "      <td>110.120.155.5</td>\n",
       "      <td>0.929</td>\n",
       "      <td>200</td>\n",
       "      <td>ruff005y</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>980</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>1930</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/png</td>\n",
       "      <td>www.bdb.mock-domain.com</td>\n",
       "      <td>t1=w1;q2=f2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td>9.0</td>\n",
       "      <td>unknown</td>\n",
       "      <td>windows_7</td>\n",
       "      <td>windows</td>\n",
       "      <td>119.120.150.2:80</td>\n",
       "      <td>114.120.159.7</td>\n",
       "      <td>0.54</td>\n",
       "      <td>200</td>\n",
       "      <td>a0yuv1jrr</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>981</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>6242</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/jgp</td>\n",
       "      <td>www.acb.mock-domain.com</td>\n",
       "      <td>u1=u1;u2=h2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows_7</td>\n",
       "      <td></td>\n",
       "      <td>113.120.157.6:80</td>\n",
       "      <td>114.120.160.10</td>\n",
       "      <td>0.311</td>\n",
       "      <td>400</td>\n",
       "      <td>ktr6g0yp8</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>982</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>2611</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.bcc.mock-domain.com</td>\n",
       "      <td>r1=q1;c2=f2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>ios</td>\n",
       "      <td>105.120.150.20:80</td>\n",
       "      <td>104.120.153.6</td>\n",
       "      <td>0.575</td>\n",
       "      <td>409</td>\n",
       "      <td>426krx</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>983</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>4038</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.bb.mock-domain.com</td>\n",
       "      <td>x1=f1;g2=y2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>unknown</td>\n",
       "      <td>windows_7</td>\n",
       "      <td></td>\n",
       "      <td>101.120.154.3:80</td>\n",
       "      <td>105.120.156.10</td>\n",
       "      <td>0.969</td>\n",
       "      <td>200</td>\n",
       "      <td>v3k47uo64</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>984</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>7312</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.bdd.mock-domain.com</td>\n",
       "      <td>f1=j1;f2=t2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows</td>\n",
       "      <td>113.120.154.19:80</td>\n",
       "      <td>112.120.155.1</td>\n",
       "      <td>0.215</td>\n",
       "      <td>400</td>\n",
       "      <td>uhmx700</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>985</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>2457</td>\n",
       "      <td>none</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>image/jgp</td>\n",
       "      <td>www.ccd.mock-domain.com</td>\n",
       "      <td>y1=o1;m2=d2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td></td>\n",
       "      <td>115.120.157.17:80</td>\n",
       "      <td>116.120.153.5</td>\n",
       "      <td>0.056</td>\n",
       "      <td>200</td>\n",
       "      <td>9sd07z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>986</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>2961</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/png</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "      <td>p1=l1;l2=h2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td>computer</td>\n",
       "      <td>windows_7</td>\n",
       "      <td>windows</td>\n",
       "      <td>117.120.155.11:80</td>\n",
       "      <td>118.120.151.3</td>\n",
       "      <td>0.325</td>\n",
       "      <td>200</td>\n",
       "      <td>l83moqg53</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>987</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>3422</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/xml</td>\n",
       "      <td>www.cd.mock-domain.com</td>\n",
       "      <td>o1=w1;d2=u2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>118.120.157.9:80</td>\n",
       "      <td>108.120.151.0</td>\n",
       "      <td>0.759</td>\n",
       "      <td>200</td>\n",
       "      <td>256hdqs</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>988</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>9489</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/jgp</td>\n",
       "      <td>www.cdc.mock-domain.com</td>\n",
       "      <td>z1=e1;r2=h2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>108.120.153.20:80</td>\n",
       "      <td>117.120.158.4</td>\n",
       "      <td>0.855</td>\n",
       "      <td>200</td>\n",
       "      <td>trji8cbmg</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>989</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>1366</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/html</td>\n",
       "      <td>www.bca.mock-domain.com</td>\n",
       "      <td>e1=y1;m2=d2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td>windows</td>\n",
       "      <td>113.120.153.6:80</td>\n",
       "      <td>106.120.155.13</td>\n",
       "      <td>0.855</td>\n",
       "      <td>400</td>\n",
       "      <td>mkg92yzgk</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>990</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>9245</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/png</td>\n",
       "      <td>www.bad.mock-domain.com</td>\n",
       "      <td>z1=w1;z2=g2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td>9.0</td>\n",
       "      <td></td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td>ios</td>\n",
       "      <td>109.120.159.17:80</td>\n",
       "      <td>102.120.151.16</td>\n",
       "      <td>0.577</td>\n",
       "      <td>400</td>\n",
       "      <td>izotf4x0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>991</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>5050</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/png</td>\n",
       "      <td>www.cab.mock-domain.com</td>\n",
       "      <td>t1=e1;i2=i2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td></td>\n",
       "      <td>105.120.154.11:80</td>\n",
       "      <td>110.120.153.11</td>\n",
       "      <td>0.375</td>\n",
       "      <td>400</td>\n",
       "      <td>brdr4e3her</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>992</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>3512</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/html</td>\n",
       "      <td>www.ab.mock-domain.com</td>\n",
       "      <td>p1=a1;o2=e2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>ios</td>\n",
       "      <td>111.120.154.19:80</td>\n",
       "      <td>112.120.150.16</td>\n",
       "      <td>0.159</td>\n",
       "      <td>200</td>\n",
       "      <td>bqsekf1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>993</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>8020</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/mp4</td>\n",
       "      <td>www.bd.mock-domain.com</td>\n",
       "      <td>a1=k1;s2=v2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>102.120.160.11:80</td>\n",
       "      <td>109.120.157.8</td>\n",
       "      <td>0.981</td>\n",
       "      <td>300</td>\n",
       "      <td>q08wxllfp</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>994</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>8485</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/png</td>\n",
       "      <td>www.da.mock-domain.com</td>\n",
       "      <td>q1=e1;r2=j2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td>9.0</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows</td>\n",
       "      <td>105.120.150.1:80</td>\n",
       "      <td>110.120.156.11</td>\n",
       "      <td>0.812</td>\n",
       "      <td>200</td>\n",
       "      <td>qbbkr4uz</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>995</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>5491</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/png</td>\n",
       "      <td>www.bdb.mock-domain.com</td>\n",
       "      <td>o1=k1;x2=a2</td>\n",
       "      <td>...</td>\n",
       "      <td>web_browser</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows_7</td>\n",
       "      <td></td>\n",
       "      <td>105.120.156.8:80</td>\n",
       "      <td>112.120.156.4</td>\n",
       "      <td>0.032</td>\n",
       "      <td>200</td>\n",
       "      <td>41h6tibi</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>996</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>4099</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>image/jgp</td>\n",
       "      <td>www.ba.mock-domain.com</td>\n",
       "      <td>e1=q1;v2=i2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows_7</td>\n",
       "      <td>ios</td>\n",
       "      <td>114.120.155.6:80</td>\n",
       "      <td>117.120.153.16</td>\n",
       "      <td>0.765</td>\n",
       "      <td>200</td>\n",
       "      <td>z3cmdz6</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>997</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>6532</td>\n",
       "      <td>challenge</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/avi</td>\n",
       "      <td>www.dc.mock-domain.com</td>\n",
       "      <td>x1=a1;l2=c2</td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>windows_7</td>\n",
       "      <td></td>\n",
       "      <td>112.120.159.2:80</td>\n",
       "      <td>117.120.158.18</td>\n",
       "      <td>0.8</td>\n",
       "      <td>200</td>\n",
       "      <td>8w4qphnz</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>998</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>840</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td>server_ip_blacklist</td>\n",
       "      <td>text/html</td>\n",
       "      <td>www.dba.mock-domain.com</td>\n",
       "      <td>l1=h1;r2=c2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>ios8_1_iphone</td>\n",
       "      <td></td>\n",
       "      <td>102.120.150.8:80</td>\n",
       "      <td>110.120.150.2</td>\n",
       "      <td>0.252</td>\n",
       "      <td>200</td>\n",
       "      <td>ie3xbu</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>999</th>\n",
       "      <td>2019-01-31 10:00:09</td>\n",
       "      <td>1.2.3.4</td>\n",
       "      <td>ddos_access_log</td>\n",
       "      <td>320</td>\n",
       "      <td>none</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>text/xml</td>\n",
       "      <td>www.add.mock-domain.com</td>\n",
       "      <td>a1=k1;s2=g2</td>\n",
       "      <td>...</td>\n",
       "      <td>robot</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>104.120.160.15:80</td>\n",
       "      <td>111.120.157.7</td>\n",
       "      <td>0.262</td>\n",
       "      <td>200</td>\n",
       "      <td>sk29v3</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>1000 rows × 39 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                    __source__        __topic__ body_bytes_sent  cc_action  \\\n",
       "__time__                                                                     \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            4222      close   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            5564      close   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            8562    captcha   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log             462       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            4817       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            2318       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log             105       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            4500       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            7435       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            2407       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            4071       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log             730       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            2700       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            8227       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            9538      close   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            9591      close   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            5215       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            1063       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            8276       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            5290  challenge   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            1815       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            3688       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            2173       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            6972       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log             484    captcha   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            3713       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            9900       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            2154       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            1768       none   \n",
       "2019-01-31 10:00:00    1.2.3.4  ddos_access_log            9948       none   \n",
       "...                        ...              ...             ...        ...   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            9471       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            5260       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            9396       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            1192       pass   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            7307       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            5186       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            6430       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            4472    captcha   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            8031       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            3674       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            1930       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            6242       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            2611       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            4038       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            7312       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            2457       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            2961       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            3422       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            9489       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            1366       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            9245       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            5050       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            3512       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            8020       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            8485       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            5491       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            4099       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log            6532  challenge   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log             840       none   \n",
       "2019-01-31 10:00:09    1.2.3.4  ddos_access_log             320       none   \n",
       "\n",
       "                    cc_blocks             cc_phase content_type  \\\n",
       "__time__                                                          \n",
       "2019-01-31 10:00:00                                    text/avi   \n",
       "2019-01-31 10:00:00                                    text/avi   \n",
       "2019-01-31 10:00:00                                   image/png   \n",
       "2019-01-31 10:00:00                                    text/xml   \n",
       "2019-01-31 10:00:00                                   image/png   \n",
       "2019-01-31 10:00:00         1     static_whitelist    image/png   \n",
       "2019-01-31 10:00:00                                    text/mp4   \n",
       "2019-01-31 10:00:00         1                         image/jgp   \n",
       "2019-01-31 10:00:00                                    text/avi   \n",
       "2019-01-31 10:00:00                                   image/jgp   \n",
       "2019-01-31 10:00:00                                    text/mp4   \n",
       "2019-01-31 10:00:00                                    text/avi   \n",
       "2019-01-31 10:00:00         1                          text/mp4   \n",
       "2019-01-31 10:00:00                                    text/avi   \n",
       "2019-01-31 10:00:00                                    text/xml   \n",
       "2019-01-31 10:00:00                                    text/xml   \n",
       "2019-01-31 10:00:00            server_ip_blacklist   text/x-flv   \n",
       "2019-01-31 10:00:00                                   image/jgp   \n",
       "2019-01-31 10:00:00                                    text/xml   \n",
       "2019-01-31 10:00:00         1                          text/avi   \n",
       "2019-01-31 10:00:00         1                        text/x-flv   \n",
       "2019-01-31 10:00:00                                   image/jgp   \n",
       "2019-01-31 10:00:00         1                         image/png   \n",
       "2019-01-31 10:00:00                                    text/avi   \n",
       "2019-01-31 10:00:00                                    text/mp4   \n",
       "2019-01-31 10:00:00                                   image/png   \n",
       "2019-01-31 10:00:00               static_whitelist     text/mp4   \n",
       "2019-01-31 10:00:00               static_whitelist     text/mp4   \n",
       "2019-01-31 10:00:00               static_whitelist     text/avi   \n",
       "2019-01-31 10:00:00                                  text/x-flv   \n",
       "...                       ...                  ...          ...   \n",
       "2019-01-31 10:00:09                                    text/mp4   \n",
       "2019-01-31 10:00:09                                   image/png   \n",
       "2019-01-31 10:00:09                                    text/avi   \n",
       "2019-01-31 10:00:09                                   image/jgp   \n",
       "2019-01-31 10:00:09         1                         text/html   \n",
       "2019-01-31 10:00:09         1                        text/x-flv   \n",
       "2019-01-31 10:00:09                      seccookie    text/html   \n",
       "2019-01-31 10:00:09                                    text/mp4   \n",
       "2019-01-31 10:00:09         1                          text/mp4   \n",
       "2019-01-31 10:00:09               static_whitelist    image/jgp   \n",
       "2019-01-31 10:00:09                                   image/png   \n",
       "2019-01-31 10:00:09                                   image/jgp   \n",
       "2019-01-31 10:00:09         1                          text/avi   \n",
       "2019-01-31 10:00:09                                    text/mp4   \n",
       "2019-01-31 10:00:09                                    text/mp4   \n",
       "2019-01-31 10:00:09         1                         image/jgp   \n",
       "2019-01-31 10:00:09                                   image/png   \n",
       "2019-01-31 10:00:09                                    text/xml   \n",
       "2019-01-31 10:00:09                                   image/jgp   \n",
       "2019-01-31 10:00:09                                   text/html   \n",
       "2019-01-31 10:00:09                                   image/png   \n",
       "2019-01-31 10:00:09                                   image/png   \n",
       "2019-01-31 10:00:09                                   text/html   \n",
       "2019-01-31 10:00:09                                    text/mp4   \n",
       "2019-01-31 10:00:09                                   image/png   \n",
       "2019-01-31 10:00:09                                   image/png   \n",
       "2019-01-31 10:00:09                                   image/jgp   \n",
       "2019-01-31 10:00:09                                    text/avi   \n",
       "2019-01-31 10:00:09            server_ip_blacklist    text/html   \n",
       "2019-01-31 10:00:09                                    text/xml   \n",
       "\n",
       "                                        host  http_cookie  \\\n",
       "__time__                                                    \n",
       "2019-01-31 10:00:00  www.ccd.mock-domain.com  y1=g1;g2=c2   \n",
       "2019-01-31 10:00:00  www.dad.mock-domain.com  q1=x1;r2=q2   \n",
       "2019-01-31 10:00:00  www.bac.mock-domain.com  f1=x1;o2=j2   \n",
       "2019-01-31 10:00:00   www.cd.mock-domain.com  g1=x1;b2=y2   \n",
       "2019-01-31 10:00:00   www.db.mock-domain.com  k1=n1;e2=q2   \n",
       "2019-01-31 10:00:00   www.ba.mock-domain.com  u1=h1;j2=t2   \n",
       "2019-01-31 10:00:00  www.aba.mock-domain.com  s1=t1;h2=a2   \n",
       "2019-01-31 10:00:00  www.bbb.mock-domain.com  g1=p1;z2=y2   \n",
       "2019-01-31 10:00:00  www.bbb.mock-domain.com  p1=n1;t2=o2   \n",
       "2019-01-31 10:00:00  www.bdd.mock-domain.com  l1=p1;h2=j2   \n",
       "2019-01-31 10:00:00   www.ac.mock-domain.com  n1=x1;z2=e2   \n",
       "2019-01-31 10:00:00   www.bb.mock-domain.com  f1=w1;x2=b2   \n",
       "2019-01-31 10:00:00  www.aad.mock-domain.com  i1=s1;d2=y2   \n",
       "2019-01-31 10:00:00   www.db.mock-domain.com  k1=y1;e2=t2   \n",
       "2019-01-31 10:00:00   www.dd.mock-domain.com  b1=n1;e2=u2   \n",
       "2019-01-31 10:00:00   www.db.mock-domain.com  m1=r1;k2=g2   \n",
       "2019-01-31 10:00:00  www.bdd.mock-domain.com  d1=v1;w2=r2   \n",
       "2019-01-31 10:00:00  www.cbd.mock-domain.com  g1=y1;h2=m2   \n",
       "2019-01-31 10:00:00   www.bb.mock-domain.com  x1=i1;q2=z2   \n",
       "2019-01-31 10:00:00  www.bad.mock-domain.com  q1=n1;e2=u2   \n",
       "2019-01-31 10:00:00  www.dcb.mock-domain.com  q1=e1;w2=f2   \n",
       "2019-01-31 10:00:00   www.dc.mock-domain.com  u1=x1;h2=t2   \n",
       "2019-01-31 10:00:00   www.cc.mock-domain.com  c1=j1;s2=q2   \n",
       "2019-01-31 10:00:00  www.dcc.mock-domain.com  p1=p1;o2=o2   \n",
       "2019-01-31 10:00:00   www.cb.mock-domain.com  w1=q1;m2=e2   \n",
       "2019-01-31 10:00:00  www.aac.mock-domain.com  u1=j1;l2=j2   \n",
       "2019-01-31 10:00:00  www.cab.mock-domain.com  z1=m1;i2=q2   \n",
       "2019-01-31 10:00:00  www.bad.mock-domain.com  u1=q1;p2=s2   \n",
       "2019-01-31 10:00:00  www.dbc.mock-domain.com  b1=g1;k2=f2   \n",
       "2019-01-31 10:00:00   www.bc.mock-domain.com  g1=p1;n2=b2   \n",
       "...                                      ...          ...   \n",
       "2019-01-31 10:00:09  www.cbb.mock-domain.com  p1=f1;j2=t2   \n",
       "2019-01-31 10:00:09   www.da.mock-domain.com  x1=g1;l2=j2   \n",
       "2019-01-31 10:00:09   www.da.mock-domain.com  w1=t1;y2=l2   \n",
       "2019-01-31 10:00:09  www.cac.mock-domain.com  t1=q1;p2=t2   \n",
       "2019-01-31 10:00:09   www.cd.mock-domain.com  x1=u1;x2=i2   \n",
       "2019-01-31 10:00:09   www.db.mock-domain.com  s1=z1;v2=y2   \n",
       "2019-01-31 10:00:09   www.cc.mock-domain.com  l1=f1;t2=w2   \n",
       "2019-01-31 10:00:09   www.da.mock-domain.com  n1=u1;i2=l2   \n",
       "2019-01-31 10:00:09  www.acd.mock-domain.com  e1=y1;y2=w2   \n",
       "2019-01-31 10:00:09   www.da.mock-domain.com  s1=p1;w2=q2   \n",
       "2019-01-31 10:00:09  www.bdb.mock-domain.com  t1=w1;q2=f2   \n",
       "2019-01-31 10:00:09  www.acb.mock-domain.com  u1=u1;u2=h2   \n",
       "2019-01-31 10:00:09  www.bcc.mock-domain.com  r1=q1;c2=f2   \n",
       "2019-01-31 10:00:09   www.bb.mock-domain.com  x1=f1;g2=y2   \n",
       "2019-01-31 10:00:09  www.bdd.mock-domain.com  f1=j1;f2=t2   \n",
       "2019-01-31 10:00:09  www.ccd.mock-domain.com  y1=o1;m2=d2   \n",
       "2019-01-31 10:00:09   www.aa.mock-domain.com  p1=l1;l2=h2   \n",
       "2019-01-31 10:00:09   www.cd.mock-domain.com  o1=w1;d2=u2   \n",
       "2019-01-31 10:00:09  www.cdc.mock-domain.com  z1=e1;r2=h2   \n",
       "2019-01-31 10:00:09  www.bca.mock-domain.com  e1=y1;m2=d2   \n",
       "2019-01-31 10:00:09  www.bad.mock-domain.com  z1=w1;z2=g2   \n",
       "2019-01-31 10:00:09  www.cab.mock-domain.com  t1=e1;i2=i2   \n",
       "2019-01-31 10:00:09   www.ab.mock-domain.com  p1=a1;o2=e2   \n",
       "2019-01-31 10:00:09   www.bd.mock-domain.com  a1=k1;s2=v2   \n",
       "2019-01-31 10:00:09   www.da.mock-domain.com  q1=e1;r2=j2   \n",
       "2019-01-31 10:00:09  www.bdb.mock-domain.com  o1=k1;x2=a2   \n",
       "2019-01-31 10:00:09   www.ba.mock-domain.com  e1=q1;v2=i2   \n",
       "2019-01-31 10:00:09   www.dc.mock-domain.com  x1=a1;l2=c2   \n",
       "2019-01-31 10:00:09  www.dba.mock-domain.com  l1=h1;r2=c2   \n",
       "2019-01-31 10:00:09  www.add.mock-domain.com  a1=k1;s2=g2   \n",
       "\n",
       "                                       http_referer  ... ua_browser_type  \\\n",
       "__time__                                             ...                   \n",
       "2019-01-31 10:00:00   http://www.aa.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00  http://www.dab.mock-domain.com  ...     web_browser   \n",
       "2019-01-31 10:00:00  http://www.cdd.mock-domain.com  ...     web_browser   \n",
       "2019-01-31 10:00:00   http://www.ac.mock-domain.com  ...           robot   \n",
       "2019-01-31 10:00:00   http://www.bc.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00  http://www.cdc.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00   http://www.bd.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00   http://www.db.mock-domain.com  ...     web_browser   \n",
       "2019-01-31 10:00:00   http://www.bd.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00  http://www.caa.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00  http://www.bdb.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00  http://www.aad.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00   http://www.bd.mock-domain.com  ...     web_browser   \n",
       "2019-01-31 10:00:00   http://www.ac.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00   http://www.bc.mock-domain.com  ...           robot   \n",
       "2019-01-31 10:00:00   http://www.ab.mock-domain.com  ...           robot   \n",
       "2019-01-31 10:00:00   http://www.bc.mock-domain.com  ...     web_browser   \n",
       "2019-01-31 10:00:00   http://www.ba.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00   http://www.cd.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00   http://www.cd.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00   http://www.dc.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00  http://www.daa.mock-domain.com  ...     web_browser   \n",
       "2019-01-31 10:00:00  http://www.adb.mock-domain.com  ...     web_browser   \n",
       "2019-01-31 10:00:00   http://www.bd.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00  http://www.cdd.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00   http://www.bc.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00  http://www.dbd.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00   http://www.bc.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:00  http://www.bcc.mock-domain.com  ...           robot   \n",
       "2019-01-31 10:00:00  http://www.abc.mock-domain.com  ...     web_browser   \n",
       "...                                             ...  ...             ...   \n",
       "2019-01-31 10:00:09  http://www.ddc.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:09   http://www.ad.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:09  http://www.cdd.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:09  http://www.cdb.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:09  http://www.dbd.mock-domain.com  ...           robot   \n",
       "2019-01-31 10:00:09  http://www.bba.mock-domain.com  ...     web_browser   \n",
       "2019-01-31 10:00:09  http://www.ddc.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:09  http://www.bad.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:09  http://www.abc.mock-domain.com  ...     web_browser   \n",
       "2019-01-31 10:00:09   http://www.ac.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:09   http://www.dc.mock-domain.com  ...     web_browser   \n",
       "2019-01-31 10:00:09  http://www.caa.mock-domain.com  ...           robot   \n",
       "2019-01-31 10:00:09   http://www.ba.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:09   http://www.ab.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:09   http://www.da.mock-domain.com  ...           robot   \n",
       "2019-01-31 10:00:09  http://www.dba.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:09  http://www.bad.mock-domain.com  ...     web_browser   \n",
       "2019-01-31 10:00:09   http://www.dc.mock-domain.com  ...     web_browser   \n",
       "2019-01-31 10:00:09  http://www.cda.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:09  http://www.bad.mock-domain.com  ...     web_browser   \n",
       "2019-01-31 10:00:09   http://www.ba.mock-domain.com  ...     web_browser   \n",
       "2019-01-31 10:00:09  http://www.ccb.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:09  http://www.bac.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:09  http://www.bcc.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:09  http://www.dad.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:09   http://www.da.mock-domain.com  ...     web_browser   \n",
       "2019-01-31 10:00:09   http://www.aa.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:09  http://www.bbd.mock-domain.com  ...                   \n",
       "2019-01-31 10:00:09   http://www.ac.mock-domain.com  ...           robot   \n",
       "2019-01-31 10:00:09   http://www.aa.mock-domain.com  ...           robot   \n",
       "\n",
       "                    ua_browser_version ua_device_type          ua_os  \\\n",
       "__time__                                                               \n",
       "2019-01-31 10:00:00                 10                                 \n",
       "2019-01-31 10:00:00                 10                 ios8_1_iphone   \n",
       "2019-01-31 10:00:00                          computer      windows_7   \n",
       "2019-01-31 10:00:00                 10       computer      windows_7   \n",
       "2019-01-31 10:00:00                                        windows_7   \n",
       "2019-01-31 10:00:00                 10                                 \n",
       "2019-01-31 10:00:00                           unknown                  \n",
       "2019-01-31 10:00:00                          computer                  \n",
       "2019-01-31 10:00:00                 10        unknown      windows_7   \n",
       "2019-01-31 10:00:00                          computer                  \n",
       "2019-01-31 10:00:00                          computer                  \n",
       "2019-01-31 10:00:00                                        windows_7   \n",
       "2019-01-31 10:00:00                9.0        unknown                  \n",
       "2019-01-31 10:00:00                                                    \n",
       "2019-01-31 10:00:00                                                    \n",
       "2019-01-31 10:00:00                          computer                  \n",
       "2019-01-31 10:00:00                9.0                 ios8_1_iphone   \n",
       "2019-01-31 10:00:00                          computer                  \n",
       "2019-01-31 10:00:00                9.0       computer  ios8_1_iphone   \n",
       "2019-01-31 10:00:00                                    ios8_1_iphone   \n",
       "2019-01-31 10:00:00                                                    \n",
       "2019-01-31 10:00:00                 10       computer                  \n",
       "2019-01-31 10:00:00                                                    \n",
       "2019-01-31 10:00:00                 10        unknown                  \n",
       "2019-01-31 10:00:00                9.0        unknown  ios8_1_iphone   \n",
       "2019-01-31 10:00:00                                                    \n",
       "2019-01-31 10:00:00                9.0                                 \n",
       "2019-01-31 10:00:00                                                    \n",
       "2019-01-31 10:00:00                                        windows_7   \n",
       "2019-01-31 10:00:00                          computer  ios8_1_iphone   \n",
       "...                                ...            ...            ...   \n",
       "2019-01-31 10:00:09                9.0        unknown                  \n",
       "2019-01-31 10:00:09                                    ios8_1_iphone   \n",
       "2019-01-31 10:00:09                                    ios8_1_iphone   \n",
       "2019-01-31 10:00:09                9.0                     windows_7   \n",
       "2019-01-31 10:00:09                9.0                                 \n",
       "2019-01-31 10:00:09                9.0                     windows_7   \n",
       "2019-01-31 10:00:09                 10        unknown      windows_7   \n",
       "2019-01-31 10:00:09                 10        unknown                  \n",
       "2019-01-31 10:00:09                                                    \n",
       "2019-01-31 10:00:09                 10       computer                  \n",
       "2019-01-31 10:00:09                9.0        unknown      windows_7   \n",
       "2019-01-31 10:00:09                                        windows_7   \n",
       "2019-01-31 10:00:09                                                    \n",
       "2019-01-31 10:00:09                           unknown      windows_7   \n",
       "2019-01-31 10:00:09                                                    \n",
       "2019-01-31 10:00:09                                    ios8_1_iphone   \n",
       "2019-01-31 10:00:09                          computer      windows_7   \n",
       "2019-01-31 10:00:09                                                    \n",
       "2019-01-31 10:00:09                                                    \n",
       "2019-01-31 10:00:09                                    ios8_1_iphone   \n",
       "2019-01-31 10:00:09                9.0                 ios8_1_iphone   \n",
       "2019-01-31 10:00:09                                    ios8_1_iphone   \n",
       "2019-01-31 10:00:09                                                    \n",
       "2019-01-31 10:00:09                                                    \n",
       "2019-01-31 10:00:09                9.0                                 \n",
       "2019-01-31 10:00:09                                        windows_7   \n",
       "2019-01-31 10:00:09                                        windows_7   \n",
       "2019-01-31 10:00:09                                        windows_7   \n",
       "2019-01-31 10:00:09                                    ios8_1_iphone   \n",
       "2019-01-31 10:00:09                                                    \n",
       "\n",
       "                    ua_os_family      upstream_addr     upstream_ip  \\\n",
       "__time__                                                              \n",
       "2019-01-31 10:00:00               107.120.155.19:80   113.120.159.6   \n",
       "2019-01-31 10:00:00                115.120.153.9:80  112.120.154.13   \n",
       "2019-01-31 10:00:00      windows   115.120.159.1:80  114.120.155.16   \n",
       "2019-01-31 10:00:00      windows   116.120.158.5:80   111.120.160.0   \n",
       "2019-01-31 10:00:00      windows  118.120.153.13:80   111.120.157.1   \n",
       "2019-01-31 10:00:00      windows  104.120.160.16:80  114.120.157.13   \n",
       "2019-01-31 10:00:00                115.120.156.3:80   111.120.160.3   \n",
       "2019-01-31 10:00:00          ios  105.120.151.10:80   106.120.157.4   \n",
       "2019-01-31 10:00:00      windows   107.120.153.2:80  103.120.150.14   \n",
       "2019-01-31 10:00:00               101.120.155.10:80   110.120.154.8   \n",
       "2019-01-31 10:00:00                117.120.156.5:80   117.120.154.2   \n",
       "2019-01-31 10:00:00               111.120.157.20:80  108.120.152.12   \n",
       "2019-01-31 10:00:00      windows  104.120.155.13:80   101.120.159.7   \n",
       "2019-01-31 10:00:00                118.120.160.2:80   107.120.158.7   \n",
       "2019-01-31 10:00:00                107.120.158.6:80   106.120.151.5   \n",
       "2019-01-31 10:00:00      windows   116.120.150.8:80  105.120.160.11   \n",
       "2019-01-31 10:00:00      windows   101.120.157.2:80   107.120.153.3   \n",
       "2019-01-31 10:00:00               107.120.154.18:80  114.120.150.20   \n",
       "2019-01-31 10:00:00                109.120.160.8:80   120.120.152.5   \n",
       "2019-01-31 10:00:00          ios   106.120.152.1:80   117.120.159.5   \n",
       "2019-01-31 10:00:00                111.120.160.1:80   104.120.152.0   \n",
       "2019-01-31 10:00:00      windows   117.120.160.2:80  109.120.153.12   \n",
       "2019-01-31 10:00:00               115.120.151.18:80   113.120.160.3   \n",
       "2019-01-31 10:00:00                117.120.155.3:80  115.120.153.18   \n",
       "2019-01-31 10:00:00               116.120.158.17:80  110.120.158.15   \n",
       "2019-01-31 10:00:00                105.120.158.5:80  120.120.157.16   \n",
       "2019-01-31 10:00:00               118.120.154.19:80   116.120.151.4   \n",
       "2019-01-31 10:00:00      windows   102.120.157.9:80  110.120.150.18   \n",
       "2019-01-31 10:00:00          ios  113.120.160.12:80   108.120.160.8   \n",
       "2019-01-31 10:00:00      windows  107.120.150.15:80   118.120.160.4   \n",
       "...                          ...                ...             ...   \n",
       "2019-01-31 10:00:09      windows   111.120.152.5:80  113.120.154.12   \n",
       "2019-01-31 10:00:09               111.120.150.18:80   113.120.153.6   \n",
       "2019-01-31 10:00:09               104.120.157.17:80  117.120.155.17   \n",
       "2019-01-31 10:00:09      windows   105.120.156.7:80   117.120.160.3   \n",
       "2019-01-31 10:00:09                112.120.156.5:80   101.120.159.5   \n",
       "2019-01-31 10:00:09          ios  116.120.159.11:80  119.120.160.12   \n",
       "2019-01-31 10:00:09          ios   118.120.152.2:80  118.120.157.10   \n",
       "2019-01-31 10:00:09               108.120.160.14:80   103.120.156.1   \n",
       "2019-01-31 10:00:09                114.120.150.1:80  117.120.160.19   \n",
       "2019-01-31 10:00:09               101.120.153.16:80   110.120.155.5   \n",
       "2019-01-31 10:00:09      windows   119.120.150.2:80   114.120.159.7   \n",
       "2019-01-31 10:00:09                113.120.157.6:80  114.120.160.10   \n",
       "2019-01-31 10:00:09          ios  105.120.150.20:80   104.120.153.6   \n",
       "2019-01-31 10:00:09                101.120.154.3:80  105.120.156.10   \n",
       "2019-01-31 10:00:09      windows  113.120.154.19:80   112.120.155.1   \n",
       "2019-01-31 10:00:09               115.120.157.17:80   116.120.153.5   \n",
       "2019-01-31 10:00:09      windows  117.120.155.11:80   118.120.151.3   \n",
       "2019-01-31 10:00:09                118.120.157.9:80   108.120.151.0   \n",
       "2019-01-31 10:00:09               108.120.153.20:80   117.120.158.4   \n",
       "2019-01-31 10:00:09      windows   113.120.153.6:80  106.120.155.13   \n",
       "2019-01-31 10:00:09          ios  109.120.159.17:80  102.120.151.16   \n",
       "2019-01-31 10:00:09               105.120.154.11:80  110.120.153.11   \n",
       "2019-01-31 10:00:09          ios  111.120.154.19:80  112.120.150.16   \n",
       "2019-01-31 10:00:09               102.120.160.11:80   109.120.157.8   \n",
       "2019-01-31 10:00:09      windows   105.120.150.1:80  110.120.156.11   \n",
       "2019-01-31 10:00:09                105.120.156.8:80   112.120.156.4   \n",
       "2019-01-31 10:00:09          ios   114.120.155.6:80  117.120.153.16   \n",
       "2019-01-31 10:00:09                112.120.159.2:80  117.120.158.18   \n",
       "2019-01-31 10:00:09                102.120.150.8:80   110.120.150.2   \n",
       "2019-01-31 10:00:09               104.120.160.15:80   111.120.157.7   \n",
       "\n",
       "                    upstream_response_time upstream_status     user_id  \n",
       "__time__                                                                \n",
       "2019-01-31 10:00:00                  0.828             400      5opgoe  \n",
       "2019-01-31 10:00:00                  0.892             200  lxoyf6emz3  \n",
       "2019-01-31 10:00:00                  0.365             200     7t22id6  \n",
       "2019-01-31 10:00:00                  0.729             300    5m2qqov2  \n",
       "2019-01-31 10:00:00                  0.473             200      7bkyz4  \n",
       "2019-01-31 10:00:00                  0.282             300  8bml4hthq8  \n",
       "2019-01-31 10:00:00                  0.301             200   0g9p0ddk8  \n",
       "2019-01-31 10:00:00                  0.638             502     x8porfk  \n",
       "2019-01-31 10:00:00                  0.844             200      ygpjcc  \n",
       "2019-01-31 10:00:00                  0.472             300     v9wbv1i  \n",
       "2019-01-31 10:00:00                  0.234             200    hxvt75hk  \n",
       "2019-01-31 10:00:00                  0.795             400   a8fo6uzl0  \n",
       "2019-01-31 10:00:00                  0.709             200     7mso25k  \n",
       "2019-01-31 10:00:00                  0.716             300    an5nfpek  \n",
       "2019-01-31 10:00:00                  0.502             200  pgks8vv3iz  \n",
       "2019-01-31 10:00:00                  0.814             200    7oi74sqm  \n",
       "2019-01-31 10:00:00                   0.68             300  3xbz71hprc  \n",
       "2019-01-31 10:00:00                  0.257             200      8kr662  \n",
       "2019-01-31 10:00:00                  0.133             400  xexgb82p1f  \n",
       "2019-01-31 10:00:00                   0.56             200     d6k6sfa  \n",
       "2019-01-31 10:00:00                   0.91             200    1ec92q9f  \n",
       "2019-01-31 10:00:00                  0.868             200     8e9ohrt  \n",
       "2019-01-31 10:00:00                  0.376             200      387egb  \n",
       "2019-01-31 10:00:00                  0.921             200  mmm8xeh7e0  \n",
       "2019-01-31 10:00:00                  0.724             200   2emhs0wkp  \n",
       "2019-01-31 10:00:00                  0.758             300   eei5rxwww  \n",
       "2019-01-31 10:00:00                  0.128             200    ayx9p14j  \n",
       "2019-01-31 10:00:00                  0.452             300  mnnyrt54h9  \n",
       "2019-01-31 10:00:00                  0.395             502   kghxx7z6o  \n",
       "2019-01-31 10:00:00                  0.784             300  ftsf8tsfmg  \n",
       "...                                    ...             ...         ...  \n",
       "2019-01-31 10:00:09                  0.756             499  1qe240h5n0  \n",
       "2019-01-31 10:00:09                  0.897             200     5vwife4  \n",
       "2019-01-31 10:00:09                  0.511             200      47dftd  \n",
       "2019-01-31 10:00:09                  0.985             200  fy3k0x7yca  \n",
       "2019-01-31 10:00:09                  0.412             404      6utx9s  \n",
       "2019-01-31 10:00:09                  0.387             300  jy1m24di29  \n",
       "2019-01-31 10:00:09                  0.544             200     7014zrk  \n",
       "2019-01-31 10:00:09                  0.691             404     tvzs4fr  \n",
       "2019-01-31 10:00:09                   0.37             300  5k5vhfut41  \n",
       "2019-01-31 10:00:09                  0.929             200    ruff005y  \n",
       "2019-01-31 10:00:09                   0.54             200   a0yuv1jrr  \n",
       "2019-01-31 10:00:09                  0.311             400   ktr6g0yp8  \n",
       "2019-01-31 10:00:09                  0.575             409      426krx  \n",
       "2019-01-31 10:00:09                  0.969             200   v3k47uo64  \n",
       "2019-01-31 10:00:09                  0.215             400     uhmx700  \n",
       "2019-01-31 10:00:09                  0.056             200      9sd07z  \n",
       "2019-01-31 10:00:09                  0.325             200   l83moqg53  \n",
       "2019-01-31 10:00:09                  0.759             200     256hdqs  \n",
       "2019-01-31 10:00:09                  0.855             200   trji8cbmg  \n",
       "2019-01-31 10:00:09                  0.855             400   mkg92yzgk  \n",
       "2019-01-31 10:00:09                  0.577             400    izotf4x0  \n",
       "2019-01-31 10:00:09                  0.375             400  brdr4e3her  \n",
       "2019-01-31 10:00:09                  0.159             200     bqsekf1  \n",
       "2019-01-31 10:00:09                  0.981             300   q08wxllfp  \n",
       "2019-01-31 10:00:09                  0.812             200    qbbkr4uz  \n",
       "2019-01-31 10:00:09                  0.032             200    41h6tibi  \n",
       "2019-01-31 10:00:09                  0.765             200     z3cmdz6  \n",
       "2019-01-31 10:00:09                    0.8             200    8w4qphnz  \n",
       "2019-01-31 10:00:09                  0.252             200      ie3xbu  \n",
       "2019-01-31 10:00:09                  0.262             200      sk29v3  \n",
       "\n",
       "[1000 rows x 38 columns]"
      ]
     },
     "execution_count": 16,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%fetch 2019-1-31 10:0:0+8:00 ~ 2019-1-31 10:00:10+8:00"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# 返回Dataframe，无缝衔接PyData计算"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [],
   "source": [
    "%matplotlib inline\n",
    "import matplotlib.pyplot as plt\n",
    "plt.rcParams[\"figure.figsize\"] = (12, 9)\n",
    "import seaborn as sns"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "变量名：log_df\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "TransientProgressBar(value=0.0)"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/plain": [
       "InstancesProgress()"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/plain": [
       "DFViewWidget()"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>body_bytes_sent</th>\n",
       "      <th>host</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>8576</td>\n",
       "      <td>www.ad.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>4566</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>8262</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>6215</td>\n",
       "      <td>www.ad.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>8668</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>5493</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>1591</td>\n",
       "      <td>www.ab.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>8561</td>\n",
       "      <td>www.ad.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>3757</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>6065</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>8507</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>2886</td>\n",
       "      <td>www.ab.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td>3081</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>8330</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td>7668</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>6868</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>16</th>\n",
       "      <td>3764</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>5828</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>18</th>\n",
       "      <td>7732</td>\n",
       "      <td>www.ad.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>19</th>\n",
       "      <td>2176</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20</th>\n",
       "      <td>9343</td>\n",
       "      <td>www.ab.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>21</th>\n",
       "      <td>4693</td>\n",
       "      <td>www.ad.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>22</th>\n",
       "      <td>988</td>\n",
       "      <td>www.ab.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>23</th>\n",
       "      <td>5807</td>\n",
       "      <td>www.ad.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>24</th>\n",
       "      <td>5252</td>\n",
       "      <td>www.ad.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25</th>\n",
       "      <td>7529</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>26</th>\n",
       "      <td>5705</td>\n",
       "      <td>www.ad.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>27</th>\n",
       "      <td>2381</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>28</th>\n",
       "      <td>8500</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>29</th>\n",
       "      <td>3722</td>\n",
       "      <td>www.ab.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11116</th>\n",
       "      <td>5886</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11117</th>\n",
       "      <td>8844</td>\n",
       "      <td>www.ab.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11118</th>\n",
       "      <td>806</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11119</th>\n",
       "      <td>9815</td>\n",
       "      <td>www.ab.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11120</th>\n",
       "      <td>4991</td>\n",
       "      <td>www.ab.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11121</th>\n",
       "      <td>8588</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11122</th>\n",
       "      <td>2485</td>\n",
       "      <td>www.ad.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11123</th>\n",
       "      <td>6975</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11124</th>\n",
       "      <td>3837</td>\n",
       "      <td>www.ab.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11125</th>\n",
       "      <td>6868</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11126</th>\n",
       "      <td>230</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11127</th>\n",
       "      <td>7009</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11128</th>\n",
       "      <td>652</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11129</th>\n",
       "      <td>1713</td>\n",
       "      <td>www.ab.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11130</th>\n",
       "      <td>6328</td>\n",
       "      <td>www.ab.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11131</th>\n",
       "      <td>4692</td>\n",
       "      <td>www.ad.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11132</th>\n",
       "      <td>6793</td>\n",
       "      <td>www.ab.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11133</th>\n",
       "      <td>7718</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11134</th>\n",
       "      <td>9733</td>\n",
       "      <td>www.ad.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11135</th>\n",
       "      <td>1142</td>\n",
       "      <td>www.ad.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11136</th>\n",
       "      <td>3414</td>\n",
       "      <td>www.ad.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11137</th>\n",
       "      <td>4492</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11138</th>\n",
       "      <td>3436</td>\n",
       "      <td>www.ad.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11139</th>\n",
       "      <td>918</td>\n",
       "      <td>www.ab.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11140</th>\n",
       "      <td>7297</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11141</th>\n",
       "      <td>6994</td>\n",
       "      <td>www.aa.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11142</th>\n",
       "      <td>8216</td>\n",
       "      <td>www.ab.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11143</th>\n",
       "      <td>3063</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11144</th>\n",
       "      <td>9870</td>\n",
       "      <td>www.ac.mock-domain.com</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11145</th>\n",
       "      <td>7784</td>\n",
       "      <td>www.ab.mock-domain.com</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>11146 rows × 2 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "      body_bytes_sent                    host\n",
       "0                8576  www.ad.mock-domain.com\n",
       "1                4566  www.ac.mock-domain.com\n",
       "2                8262  www.aa.mock-domain.com\n",
       "3                6215  www.ad.mock-domain.com\n",
       "4                8668  www.aa.mock-domain.com\n",
       "5                5493  www.ac.mock-domain.com\n",
       "6                1591  www.ab.mock-domain.com\n",
       "7                8561  www.ad.mock-domain.com\n",
       "8                3757  www.ac.mock-domain.com\n",
       "9                6065  www.aa.mock-domain.com\n",
       "10               8507  www.ac.mock-domain.com\n",
       "11               2886  www.ab.mock-domain.com\n",
       "12               3081  www.ac.mock-domain.com\n",
       "13               8330  www.aa.mock-domain.com\n",
       "14               7668  www.ac.mock-domain.com\n",
       "15               6868  www.ac.mock-domain.com\n",
       "16               3764  www.ac.mock-domain.com\n",
       "17               5828  www.ac.mock-domain.com\n",
       "18               7732  www.ad.mock-domain.com\n",
       "19               2176  www.aa.mock-domain.com\n",
       "20               9343  www.ab.mock-domain.com\n",
       "21               4693  www.ad.mock-domain.com\n",
       "22                988  www.ab.mock-domain.com\n",
       "23               5807  www.ad.mock-domain.com\n",
       "24               5252  www.ad.mock-domain.com\n",
       "25               7529  www.aa.mock-domain.com\n",
       "26               5705  www.ad.mock-domain.com\n",
       "27               2381  www.ac.mock-domain.com\n",
       "28               8500  www.ac.mock-domain.com\n",
       "29               3722  www.ab.mock-domain.com\n",
       "...               ...                     ...\n",
       "11116            5886  www.aa.mock-domain.com\n",
       "11117            8844  www.ab.mock-domain.com\n",
       "11118             806  www.ac.mock-domain.com\n",
       "11119            9815  www.ab.mock-domain.com\n",
       "11120            4991  www.ab.mock-domain.com\n",
       "11121            8588  www.aa.mock-domain.com\n",
       "11122            2485  www.ad.mock-domain.com\n",
       "11123            6975  www.ac.mock-domain.com\n",
       "11124            3837  www.ab.mock-domain.com\n",
       "11125            6868  www.ac.mock-domain.com\n",
       "11126             230  www.aa.mock-domain.com\n",
       "11127            7009  www.ac.mock-domain.com\n",
       "11128             652  www.aa.mock-domain.com\n",
       "11129            1713  www.ab.mock-domain.com\n",
       "11130            6328  www.ab.mock-domain.com\n",
       "11131            4692  www.ad.mock-domain.com\n",
       "11132            6793  www.ab.mock-domain.com\n",
       "11133            7718  www.aa.mock-domain.com\n",
       "11134            9733  www.ad.mock-domain.com\n",
       "11135            1142  www.ad.mock-domain.com\n",
       "11136            3414  www.ad.mock-domain.com\n",
       "11137            4492  www.aa.mock-domain.com\n",
       "11138            3436  www.ad.mock-domain.com\n",
       "11139             918  www.ab.mock-domain.com\n",
       "11140            7297  www.aa.mock-domain.com\n",
       "11141            6994  www.aa.mock-domain.com\n",
       "11142            8216  www.ab.mock-domain.com\n",
       "11143            3063  www.ac.mock-domain.com\n",
       "11144            9870  www.ac.mock-domain.com\n",
       "11145            7784  www.ab.mock-domain.com\n",
       "\n",
       "[11146 rows x 2 columns]"
      ]
     },
     "execution_count": 17,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%log host: www.a?.mock* | select body_bytes_sent, host limit 100000"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAAawAAAEKCAYAAABOjWFfAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADl0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uIDMuMC4yLCBodHRwOi8vbWF0cGxvdGxpYi5vcmcvOIA7rQAAIABJREFUeJzt3Xm8VXW9//HXWxARSUXlKiIF4lDWvZYRYk6VZdggXoesm4LmTU1Lrazr0M0hNct+aeZcjmXOerVMkxyQVNCDCM6JkIoiIiAOIAh+fn98vwf2Oe4DbM7eZ511fD8fj/M4a33X9Fmfvdf67DXstRURmJmZdXarFR2AmZnZynDBMjOzUnDBMjOzUnDBMjOzUnDBMjOzUnDBMjOzUnDBMjOzUnDBMjOzUnDBMjOzUuhedAAdbYMNNoiBAwcWHYaZWalMmDDh1YjoW2QM77uCNXDgQJqamooOw8ysVCQ9V3QMPiVoZmal4IJlZmal4IJlZmal4IJlZmal4IJlZmal4IJlZmal4IJlZmal4ILVSb0yb37RIZi16YFpDxQdQpexcNasokMoDResTmji1Jnsdsr1TJw2s+hQuoz5z4wtOoQu46x7z+LovxzN2WPPLjqU0ntt0iTG7bU38yZPLjqUUmhowZJ0iaRXJD1W0baepNGSnsn/++R2STpb0hRJkyVtUzHNqDz+M5JGVbR/UtKjeZqzJamR69MRFi95lx9edjcAR192N4uXvFtwROU35/Zf8OpVhzHnb2cUHUrpvbXoLa6bdB0A1zxyDW8teqvgiMorFi/myRNPAuCJE04kFi8uOKLOr9FHWJcBw1u1HQPcGRGbA3fmfoDdgM3z38HA+ZAKHHACsC0wFDihucjlcb5dMV3rZZXOlWOeYN6CRQC8Nn8RV977RMERlduSRW/y5oN/BODN8VewZNGbBUdUbodcd0iL/kOvO7SgSMpv+vXXs2j2bAAWzZnD9OtvKDiizq+hBSsi7gXmtGoeAVyeuy8H9qhovyKSccC6kvoBXwRGR8SciJgLjAaG52FrR8S4iAjgiop5ldKrry/gnNsfbtF2zm0PM/uNBQVFVH4vX7xfi/6ZF+9fUCTl1/R8E9PmTGvRNnXOVB6e/nAbU1hbFs2ezdQLL1rWEMHUiy5i0ZzWu0urVMQ1rA0jYkbufhnYMHf3B16oGG96blte+/Qq7e8h6WBJTZKaZnXiC5x/HPM470bLtncjtVvtFkwbz5JZz7ZoWzxrCgumPVhQROV21tizqrafee+ZHRxJ+b10yy2wZEnLxsWLeemWPxcTUEkUetNFPjKKFY7Y/uVcFBFDImJI376FPh1/uabMfG1p94WHfnFZ+8uvVRvdVmDu7acv7f63kZdUbbeV94OdfwDA8Z8/nuM/f/zS9u/v9P2iQiqvisvtW/9m2QeB0l+Eb7AiCtbMfDqP/P+V3P4iMKBivE1y2/LaN6nSXlpHffmTAJy47/bMmLvsWsuRud1q02f4sQCsP+IUlsx7qaL9mLYmseXYZpNt+NbQbzHj9RnMeH0G3xr6LTZdb1O22WSbFU9sLWy8++6oe3e2PPYY3n75ZQDUvTv9dv9qwZF1bkUUrFuA5jv9RgE3V7SPzHcLDgPm5VOHfwN2ldQn32yxK/C3POx1ScPy3YEjK+ZVSpv168PBX9ial+a8yUtz3uTgL2zNzh/ZhM369VnxxPYeaw4aSre+g1u0de+7GWsOGlpQRF3PBftcUHQIpdRjvfUYdPC3lzVIDDrkYHqst15xQZVAQ3/AUdJVwGeADSRNJ93tdzpwraSDgOeAr+XR/wp8CZgCzAcOBIiIOZJ+BjyUxzs5IpqvTB5GuhNxTeC2/NelnLbfTkWHUGq9t9qVxa+lA+91dv4OvbcbWXBEXctaPdYqOoTSWrJgAUsWpBuqPnTAKJbM98MCVqShBSsivtHGoF2qjBvA4W3M5xLgkirtTcDH2hNjZ3HCNfdVbf/5TeOXdp+07/YdFU6X1a1H76JDMLNV1NCCZVaU2Tf/ZLnt6484pSPDKb1TR5+63Pbjv3B81eFm9eSCZWbWgZ4+7ecrHLblccd2VDil4mcJmplZKbhgmZlZKbhgmZlZKfgalpm18N0bv9vuac7Z85x6hWO2lAtWQb59/h3tnuZ339m1XuGYmXV6LljWJcy8/MB2jb/hqEvrGY7ZUpOOOKLd02x9tn8sE3wNy8zMSsIFy8zMSsEFy8zMSsEFy8zMSsEFy8zMSsEFy8zMSsEFy8zMSsEFy8zMSsEFy8zMSsFPumiQr5x2Y+HL+MtxezY8BjOzjuKCZZ3eS7/5YqdYxsZH/q3hcXSEvS7bq/Bl3HDADQ2PwboeFywzs3YYv8/XCl/Gttdd2/AYOgNfwzIzs1JwwTIzs1JwwTIzs1JwwTIzs1JwwTIzs1JwwTIzs1JwwTIzs1JwwTIzs1JwwTIzs1IorGBJ+r6kxyU9JukqST0lDZI0XtIUSddI6pHHXSP3T8nDB1bM59jc/rSkxj/Dx8zMClFIwZLUHzgCGBIRHwO6AV8HfgGcGRGbAXOBg/IkBwFzc/uZeTwkbZWn+ygwHDhPUreOXBczM+sYRZ4S7A6sKak70AuYAXwOuD4PvxzYI3ePyP3k4btIUm6/OiIWRsQ0YAowtIPiNzOzDlRIwYqIF4FfAc+TCtU8YALwWkQszqNNB/rn7v7AC3naxXn89Svbq0xjZmZdSFGnBPuQjo4GARsDa5FO6TVqeQdLapLUNGvWrEYtxszMGqioU4KfB6ZFxKyIeAe4EdgeWDefIgTYBHgxd78IDADIw9cBZle2V5lmqYi4KCKGRMSQvn37NmJ9zMyswYoqWM8DwyT1yteidgGeAO4G9s7jjAJuzt235H7y8LsiInL71/NdhIOAzYEHO2gdzMysAxXyA44RMV7S9cDDwGJgInARcCtwtaRTctvFeZKLgT9ImgLMId0ZSEQ8LulaUrFbDBweEUs6dGXMzKxDFPaLwxFxAnBCq+apVLnLLyLeBvZpYz6nAqfWPUAzM+tU/KQLMzMrBRcsMzMrBRcsMzMrhcKuYZlZ7bb/7fZFh1AX9ViP+753Xx0isTJxwarikz+6ougQ6qIe6zHhjJF1iMSscxqz085Fh1AX9ViPne8dU4dIGssFyxru+ZP/vegQ6qIe6/HBnz5ah0jM3p98DcvMzErBBcvMzErBBcvMzErBBcvMzErBBcvMzEphpQuWpPd8caJam5mZWSPUcoT125VsMzMzq7sVfg9L0nbAp4G+kn5QMWhtoFujAjMzM6u0Ml8c7gH0zuN+oKL9dZb92KKZmVlDrbBgRcQYYIykyyLiuQ6IyczM7D1qeTTTGpIuAgZWThcRn6t3UGZmZq3VUrCuAy4Afg/4Z+jNzKxD1VKwFkfE+Q2LxMzMbDlqua39z5IOk9RP0nrNfw2LzMzMrEItR1ij8v8fVbQFsGn9wjEzM6tupQtWRAxqZCBmZmbLU8ujmXpJ+km+UxBJm0v6SuNCMzMzW6aWa1iXAotIT70AeBE4pe4RmZmZVVFLwRocEb8E3gGIiPmAGhKVmZlZK7UUrEWS1iTdaIGkwcDChkRlZmbWSi13CZ4A3A4MkHQlsD1wQCOCMjMza62WuwRHS3oYGEY6FXhkRLzasMjMzMwq1PoDjm9HxK3AusBxkj7UsMjMzMwq1HIN63xgvqStgR8AzwJXrOqCJa0r6XpJT0l6UtJ2+ekZoyU9k//3yeNK0tmSpkiaLGmbivmMyuM/I2lU20s0M7Myq6VgLY6IAEYA50bEubT8faxa/Qa4PSI+DGwNPAkcA9wZEZsDd+Z+gN2AzfPfwaTiSX401AnAtsBQ4ITmImdmZl1LLQXrDUnHAvsBt0paDVh9VRYqaR1gJ+BigIhYFBGvkYrh5Xm0y4E9cvcI4IpIxgHrSuoHfBEYHRFzImIuMBoYvioxmZlZ51ZLwdqXdBv7QRHxMrAJcMYqLncQMAu4VNJESb+XtBawYUTMyOO8DGyYu/sDL1RMPz23tdVuZmZdzEoXrIh4OSJ+HRFjc//zEbH0GpakB2pYbndgG+D8iPgE8BbLTv81Ly/I3/lqL0kHS2qS1DRr1qx6zNLMzDpYLUdYK9KzhnGnA9MjYnzuv55UwGbmU33k/6/k4S8CAyqm3yS3tdXeQkRcFBFDImJI3759awjTzMw6i3oWrJU+GsqnFF+QtGVu2gV4AriFZT9jMgq4OXffAozMdwsOA+blU4d/A3aV1CffbLFrbjMzsy6mlidd1Nv3gCsl9QCmAgeSCui1kg4CngO+lsf9K/AlYAowP49LRMyR9DPgoTzeyRExp+NWwczMOko9C1ZND8KNiEeAIVUG7VJl3AAOb2M+lwCX1LJsMzMrn1qedLFWvpUdSVtI2l1S5W3t+9c9OjMzs6yWa1j3Aj0l9QfuIBWoy5oHRsRj9Q3NzMxsmVoKlvJvYO0JnBcR+wAfbUxYZmZmLdVUsCRtB3wTuDW3dat/SGZmZu9VS8E6CjgWuCkiHpe0KXB3Y8IyMzNrqZbfwxoDjJHUK/dPBY5oVGBmZmaVarlLcDtJTwBP5f6tJZ3XsMjMzMwq1HJK8CzS09FnA0TEJNIT183MzBqupkczRcQLrZqW1DEWMzOzNtXypIsXJH0aiPyF4SNJP7poZmbWcLUcYR1KejxSf9IT0T8OHNaIoMzMzFqr5Qhry4j4ZmWDpO2B++obkpmZ2XvVUrB+S/rNqhW1mVkDjBs3joXPLCw6jE5j3LhxDBs2rOgwrAOtsGDlp1t8Gugr6QcVg9amCz7pYty4cbzz4hNFh9FpeKdgXdW4ceN46O0FRYfRaaxRgm19ZY6wegC987gfqGh/Hdi7EUFZ1zFu3Dj++S/fTNpsi3bsFIYNG8YaD61R54jKq7PvXK3+VliwKp5wcVNETO6AmAo1bNgwVr/hn0WH0Wl4p2Bd1bBhw1jYc82iw+g0yrCt13IN61xJa5B+UuTKiJjXmJCsKxk2bBgb39Hlzhyvsg+WYKdg1lmt9G3tEbEjsB8wAJgg6U+SvtCwyMzMzCrU+qSLfwI/Af4H2Bk4W9JTkvZsRHBmZmbNann47X9IOpP0dIvPAV+NiI/k7jMbFJ+ZmRlQ+/ewLgaOi4il94JGxEuSflL3yMzMzCrU8ntYO0vqAXxYUgBPR8SiPOwPjQrQzMwMaihYkr4EXAg8CwgYJOmQiLitUcGZmZk1q+WU4K+Bz0bEFABJg4FbARcsMzNruFruEnyjuVhlU4E36hyPmZlZVSvzLMHmW9abJP0VuBYIYB/goQbGZmZmttTKnBL8akX3TNL3rwBmAT3rHpGZmVkVK/MswQNXZkaSjo2In7c/JDMzs/eq6UkXK7BPHedlZmbWQj0Lluo4LzMzsxbqWbCi1gkkdZM0UdJfcv8gSeMlTZF0Tf6iMpLWyP1T8vCBFfM4Nrc/LemL9VoZMzPrXIo+wjqS9GzCZr8AzoyIzYC5wEG5/SBgbm4/M4+HpK2ArwMfBYYD50nyb1mYmXVBtTz8dv0VjHJdLQuWtAnwZeD3uV+kB+len0e5HNgjd4/I/eThu+TxRwBXR8TCiJgGTAGG1hKHmZmVQy1HWOMkXSfpS7lYtBARp9W47LOAHwPv5v71gdciYnHunw70z939gRfychYD8/L4S9urTLOUpIMlNUlqmjVrVo1hmplZZ1BLwdoCuAjYH3hG0mmStliVhUr6CvBKRExYlelrFREXRcSQiBjSt2/fjlikmZnVWS2/OBwRMToivgF8GxgFPChpjKTtalzu9sDukv4FXE06FfgbYF1Jzd8N2wR4MXe/SPqlY/LwdYDZle1VpjEzsy6kpmtYko6U1AQcDXwP2AD4IfCnWhYaEcdGxCYRMZB008RdEfFN4G5g7zzaKODm3H1L7icPvysiIrd/Pd9FOAjYHHiwlljMzKwcanla+wPAH4A9ImJ6RXuTpAvqFM//AFdLOgWYSPrBSPL/P0iaAswhFTki4nFJ1wJPAIuBwyNiSZ1iMTOzTqSWgrVlPqp5j4j4xaoGEBH3APfk7qlUucsvIt6mjSdpRMSpwKmrunwzMyuHlXla+5/JXwqucnMgEbF7/cMyMzNraWWOsH6V/+8JbAT8Mfd/g/T0djMzs4Zbmae1jwGQ9P8iYkjFoD/nGzDMzMwarpbvYa0ladPmnnxX3lr1D8nMzOy9arnp4vvAPZKmkp4b+CHg4IZEZWZm1spKF6yIuF3S5sCHc9NTEbGwMWGZmZm1tNIFS9LqwCHATrnpHkkXRsQ7DYnMzMysQi2nBM8HVgfOy/3757b/rndQZmZmrdVSsD4VEVtX9N8laVK9AzIzM6umlrsEl0ga3NyT7xj0Y5DMzKxD1HKE9SPg7nyXIMBA4MC6R2RmZlZFLUdY9wEXkn5wcU7ufqARQZmZmbVWS8G6AhgE/Az4LbAp6entZmZmDVfLKcGPRcRWFf13S3qi3gGZmZlVU8sR1sOShjX3SNoW8LMEzcysQ6zMz4s8Svp5kdWB+yU9n/s/BDzV2PDMzMySlTkl+JWGR2FmZrYCK/PzIs91RCBmZmbLU8s1LDMzs8K4YJmZWSm4YJmZWSnU8j2s940JZ4xs9zy+ctqNdYikff5y3J5Fh2BmVjcuWGYlct/37mv3PPa6bK86RNI+NxxwQ9EhWAn5lKCZmZWCj7Cs4T7400fbNf1Lv/linSJpn42P/FvRIVid7XzvmHbPY/w+X6tDJO2z7XXXFh1Ch/ARlpmZlYILlpmZlYILlpmZlYILlpmZlUIhBUvSAEl3S3pC0uOSjszt60kaLemZ/L9PbpeksyVNkTRZ0jYV8xqVx39G0qgi1sfMzBqvqCOsxcAP8w9CDgMOl7QVcAxwZ0RsDtyZ+wF2AzbPfwcD50MqcMAJwLbAUOCE5iJnZmZdSyEFKyJmRMTDufsN4EmgPzACuDyPdjmwR+4eAVwRyThgXUn9gC8CoyNiTkTMBUYDwztwVczMrIMUfg1L0kDgE8B4YMOImJEHvQxsmLv7Ay9UTDY9t7XV3noZB0tqktQ0a9asusZvZmYdo9CCJak3cANwVES8XjksIoL0y8btFhEXRcSQiBjSt2/feszSzMw6WGEFS9LqpGJ1ZUQ0Pyl2Zj7VR/7/Sm5/ERhQMfkmua2tdjMz62KKuktQwMXAkxHx64pBtwDNd/qNAm6uaB+Z7xYcBszLpw7/BuwqqU++2WLX3GZmZl1MUc8S3B7YH3hU0iO57TjgdOBaSQcBzwHND+n6K/AlYAowHzgQICLmSPoZ8FAe7+SImNMxq2BmZh2pkIIVEf8A1MbgXaqMH8DhbczrEuCS+kVnZmadUeF3CZqZma0MFywzMysFFywzMysFFywzMysFFywzMysFFywzMyuFor6H1eX95bg9lzv82+ff0e5l/O47u7Z7HmZmZeEjLDMzKwUfYZm9z9xwwA3LHf7dG7/b7mWcs+c57Z5HWWx73bXLHT7piCPavYytzz673fPoCnyEZWZmpeAjLOv0Nj5yxc8znnn5ge1axoajLm3X9GbWeD7CMjOzUnDBMjOzUnDBMjOzUnDBMjOzUnDBMjOzUnDBMjOzUnDBMjOzUnDBMjOzUvAXhwvS+sG1J1xz3wqnOWnf7RsVjplZp+eCZWYtVHsO4KmjT13uNMd/4fhGhVN6rZ8D+PRpP1/hNFsed2yjwik1FyzrElo/Wmn2zT9Z7vjrjzilkeGYWQP4GpaZmZWCC5aZmZWCC5aZmZWCIqLoGDrUkCFDoqmpqegw2nThHZNa9B+y69YFRVJuvobVGBePv7hF/0HbHlRQJOX3r0vf+5M2Aw9s38/kNJKkCRExpMgYfNOFdUnNBWnemPNatK+z82FFhGNmdeBTgma2yha/u7joEOx9xAWrk/nmjh9h4/V6s/F6vblo9CTeXLCo6JBKrfd2I+m+bn+6r9ufeWPOZ8miN4sOqdTW6L4G/dbuR7+1+3HJg5dwzSPXFB1SaQ3Yd196brQRPTfaiOcuvYwB++5bdEidXpcoWJKGS3pa0hRJxxQdT3t869zbWvXfXlAkXcPLF+/H7Jt/Qrd1NgZg5sX7FxxRec1+azYX3H9Bi7bz7zufOfPnFBRRuT38ncN4+uen03OjjZb22/KVvmBJ6gacC+wGbAV8Q9JWxUa1ah58ZgbPzpzHidfcxycHbwjAszNfo2nKywVHVk4Lpo1nyaxnAXjlim8BsHjWFBZMe7DIsErrqoevIghO/fupnPr39OSLILhq4lUFR1Y+cydMYP60aQD07NcPgPnTpjF34sQiw+r0Sl+wgKHAlIiYGhGLgKuBEQXHtEp+dfOyHelXT7txafcvb/YOdlXMvf30mtpt+abOmVq9/dXq7da2KRWPaxr/tWWnAqec9ZsiwimNrlCw+gMvVPRPz22l8+M9tq3ePmJoB0fSNfQZXv15bH2Gl/qscWEO3+Hwqu2H7eBTWbXa7Kij2mg/soMjKZeuULBWSNLBkpokNc2aNavocNo0ZLONGLzhOi3aBm+4LkM226igiMptzUFD6dZ3cIu27n03Y81B/gCwKgavP5jtB7X8xYAdBu3A4PUHtzGFtaXPJz5Br0GDWrT1GjSIPp/4REERlUNXKFgvAgMq+jfJbUtFxEURMSQihvTt27dDg6vVJYfv1qp/eEGRdA0bHfTHFv0bHvSHgiLpGk4efjKrKe02VtNqnDT8pIIjKq9tzj9vuf32Xl2hYD0EbC5pkKQewNeBWwqOaZX1XrMH39jhI0C6xb33mj0KjqjcuvXoTe+h+wHQe9uRdOvRu+CIyq1n954cuWM6bXXUTkfRs3vPgiMqr269erHx3nsD0P9r+9CtV6+CI+r8usSjmSR9CTgL6AZcEhFt/nhPZ380U7N/PPkiO3yklJfiOqX5z4yl1+Y7Fh1Gl/HUzKf48IYfLjqMLmH2Aw+w/nbbFR3GCnWGRzN1iYJVi7IULDOzzqQzFKyucErQzMzeB1ywzMysFFywzMysFFywzMysFFywzMysFFywzMysFFywzMysFN5338OSNAt4rug4VsIGwKtFB9GFOJ/15XzWT1ly+aGIKPTZdu+7glUWkpqK/pJeV+J81pfzWT/O5crzKUEzMysFFywzMysFF6zO66KiA+hinM/6cj7rx7lcSb6GZWZmpeAjLDMzKwUXrBWQdI+kDrmDR9JlkvZu9DS1knR/I+ffCJJOlHR0o6eplaS/Slq3kctoBEn/krRBo6epcf5DJJ3djukPkHROPWOqYdk171cavS+StLGk6xs1/3roXnQA1vlFxKeLjqGriIgvFR1DVxERTYB/3K5OIuIloKEffturUx1hSfqRpCNy95mS7srdn5P0lqRf5/4jJU3N3ZtKuk/SpyTdmNtGSFogqYekns3jtlrWUEkPSJoo6X5JW+b2NSVdLelJSTcBa7YR6z05xqY87qck3SjpGUmnVIz3A0mP5b+jKtpHSposaZKkP1SZ/8/y0VO3Vu2SdI6kpyX9Hfi3imG75PV5VNIlko6RdET+pPugpDdyvIdIWizpNUmH5nxOk3RnjvMtST+syOeC/Pd5SfdKelPSU5KulKQq+XxI0ui8bpMk/SnP96X8tzQXkgZKmpfntyDH+ENJMyUtkvSXivX7Rl63xyT9oqJ9uKSH87LurJLLb0u6TdJ7XktJx0v6p6R/AFtWtH9c0rj8Gt0k6ac5l/fkZb2eX/fv5FzOlXRK83tT0v/lWOdLOrUilzPzem6e1/l1SY9LuqM5vla5HCfphjyvJyU9kZc/TdKzVXLxZs7bq7n7QUkT8jJflrR7Hq+npEvzfCdK+mxu7ybpV3m+kyV9r1W+1sy5/HaVXK6f1+NxSb8HVDGsxXagtK2fmHPweM7TlZKOlrQk53NozueLOR+P53ztpbStfSa/1xYobS+X5+6pyvuRKvmc3PxeAX4KDFJ6T8/Lr01lLg7Ir+MCpW1luqQXcsyv5dfg0Irt8oy8fo9K2rdi+f+T2yZJOr1VzlZT2s5PoRUtZ1+ktreFN3Mcj0v6e173e3JOml/7gZLG5jw8LOnTFe2PVaz7jZJuV9qn/bJ1fHm8zfJyJuV5DW4rF/n1GiPp5hzP6ZK+qfQefVTS4GrLaCEiOs0fMAy4LnePBR4EVgdOyH8P5WHXAw8B/YFRwM9JR4tT8/Bf5eHbAzsDV1VZ1tpA99z9eeCG3P0D4JLc/R/AYmBIlenvAX6Ru48EXgL6AWsA04H1gU8CjwJrAb2Bx4FPAB8F/glskKdfL/+/jPQJ5wzgAvJNMa2WuycwGugGbAy8lqfpCbwAbJHHuwI4E7gO+BcwJefzN8DLwKnARGBmRT63zPk8K4/fnM9Fefh3gTeB/yN92HkA2KFKPu8BJuXuw/L4Q3MuNmmVi4HAu8BteZ5T8vL+Hdgjr9/H87o+D/TNr/VdeXjfvN6DWuXyRODoHPPNwBpVctn8+vTK8U8Bjs7DJgM75+6TgatzLu/Jy3sQ+D7wen69mvLrfkvO1UdzLs8AHgP+lec1L+d9L9J767bcfi2wX5VcXg08k7t7ARvlXLwEPFKZizxO5L/dgJvy6zs6r+tTwCN5vB+y7H3+4ZzbnsB3SO+H7q3y+a/8Wv0dGNnG9ns28NPc/eUcxwZU3w5GArfmHEzI+ZwAPEza1p8hvW+uz+0fzPm8CrgRmAp8Bng25/vinOdr8jJnA6tX5hPoAcwA7srth+b+/wUuz9PvVZGLA0jvieeAH+XX7u+k98Y5wPHAzDyvvVi2XW6Y59Evvw73A71a5fMe0v7uKuD4NvJZdV9EG9tCxeu/W+6+CbiDtA/duuK17wX0zN2bA025eyDwWO4+IOd4nZyL54ABVWIcD/xn7u6Z591WLj5D2p6b95MvAidV7EPPWlGN6FRHWKQ35iclrQ0sJO0QhwA7knYWvSV9ABgA/AnYKQ8bGxGLgWclfYS0c/x15fAqy1oHuC5/ojiTtIMhT/NHgIiYTHpztuWW/P9R4PGImBERC0kv9ABgB+CmiHgrIt4kbWg7Ap8jFeZX83LmVMzzf4F1IuLQiKq3cO5EKsBLIh3C35XbtwSmRcQ/c//lpDfgJ0mfdGeQ8vkmsAS4kvQGW5THu5q0wzkT+Crpw8CJ5Nk7AAAIPklEQVQLOZ/dSPn8D1KxuyMi3iXtMAdWyecOed4AuwDnAtvlXExvlQtyTH/M85wMzImIR3P3u3kZnwLuiYhZ+bW+MudiGHBvREyrksuRpB3G3vl1aW3HHNP8iHid/HpKWgdYNyLGVORyi5zLbjkHDwDv5L9LSTvj54BBpPfmSTlne5HeC6/kXK4BnE96j74G/DkvY0IbuRzBsjMhq5MK4P05v1u0ygWk13MRcDv5fUnaOU4kFbvmZezAsvf5Uzn2LUgf3i7M822dz5uBSyPiiiq5hJbbzq3A3Ipltd4O1iN9KHkuj/cAqbj2IG3rAjbNufsLcAPpvbkdsBWpUH0QWDfn+UOk9/iYvF29QtpZLs1nzsXapB0+wNukHes2pNf4xry85lwA3E0qAn8iFay/knbSD5MKxkKla5I7sGy7nAmMIb1nP59zNr9KPi8kFYhTVyKflfuitrYFWPbaQ3r9x0TEO7l7YG5fHfidpEdzXrZqY/l3RsS8iHgbeIKU46Xyvrh/RNyUY3w7r2dbuYB00NG8n3yWVFCbYx3ICnSqgpUTO41U3e8nFZrPApsBT+a2A4Gn87AdSW/g+/Is7iXtoN4hfRLaIf9VK1g/A+6OiI+RdtA9q4yzIs07wXcrupv7V/X64EOkor0egKRtJT2S/3avcV5BymdvYBwpD1sCH2BZPnuR3jgfIO0gZpA24Jmko4bd8nz+TtrBrM2yfC5h2XpW5nMeace8spbQMpeLKrrFqueyeSPYBEDSgIpcHroK85tG2uk/QsrB1qTTNM25/DfSp8n5pKP7maSjyIk5luZcNm/Aa7DiXE5hWS6/n+d5FOnopEeVGN8B3skfdt4lfSpfmD8MdKd9163vA4ZLS08DH16Rz41XMG1r75KOVNdk2ba+ISmHT5IK+AakbX0bUnGZwbJt9V5gW5a9Nz9IKjZt5pN0duJJWm7rrT8Utu5fWPG/+b3Z3N2d9m3r9wOfldQTQNJ/VuRzVW+uaH7toWK/VPH6w7L30dakA4Jq7yNouU+rzGd7tN5PVm73K5x/pypY2VjSqZx7c/ehwMT8IlQOm0gqZgsjYl7FtEcBD0TELNJpuS1Jh/qtrUM6JIVUIJvdC/wXgKSPkY4q2rMue0jqJWkt4D9z213APpLWz8tZr2Ka24HTgVslfSAixkfEx/PfLTm+fZWuNfTLOYC0YQ+UtFnu35+0Yxyb1/UBln0AmFWRz+Zhr5HytZC0g/gQqXgeBbyb87kOqfitKJ8zSIUN0s7kcNLGuYek/q1ysbIeBHaWtIHSdb1v5PUbB+wkaVCVXE4EDgFukbRxRLxQkcsLci73yNcKPkDaGZLfT3MlNR8BVuZyQJ7vWGB3YF5FLgeQPnm/kvP0Nun0xzBSwTqKlN/ZQB9SIVpRLudV5HId0us0nlT8urXKRS3GAt/MOduCtMN/mnTEcYik7nlYZT5/SjoaOhcgIs6tyOdLtNx2dsvr2LysatvBQ6Si1LytN58liFbDFpOOXBeSjlib57k3MDe/N3uRjniWl8+ngcEs20H3BL5A+mA2knSK+YWKXNRiLMu2y76kI54HSfk8UFKvnJfKfF5MOmK7VlL3iLipIp9NtL0vamtbWFnrADNyEdufdNagZhHxBjBd0h45xjXyeraVi3brrAWrH6nozCRt9GMrhg0gnQJaQnpz/aNi2vGkT2n35v7JwKPNnziUbjBo/mT9S+DnkibSsrKfTzr1+CTp2sWE5gGSfl/LJ5+IeJh0XerBHNvvI2JiRDxOuoY0Runi769bTXcd8DvSjrb1jQI3kc7vP0G6TvVAnuZt0tHndflQ/13SdbCxpDdkU87nO6SCQsWwB0inHlYjbawjSdc7JpLyuSSP/yzwesUnuI+yrGDOBc7O+RwN9MxxHAIsIJ1yWZ+0IxpP2oEMWMlUEhEzgGNIn5QnARMi4ua8szoYuDHn8ppW0/2D9CHnVrW6xTq/Ptfk+d2WY2s2CjhD0mTSNbSTc756AJNzLhcBzad4xpIK0ETSTmgh6ejudFJRfYKUy7fz+E8Cb1fkchjp0y6k65vn5VzeB6yWTw8OB/6b9KHmftJrPIn0Hj1pZfJY4bw830dzDg7Ip2l+TzpKnJzz+V+tpjsSWLONi/AnkT48PE46mnke2t4OWHaNunlbX5LzQsWwe0nbah/SkXLztjo+t83O/TOBlyvy2YdckEl5/2We5kZg/bxuPyLlbldSEd2QdEr+ANJ2VsvXD24i7W8mkT6Q/jgiXo6I20mnmpskPUJ6Ly4VEb8mvWf+IKn1/rjqvqitbaGGWM8DRuUcfBh4q4ZpW+8H9weOyNvJ/aQzEFVzUcsy2lx29cskZmZmnUtnPMIyMzN7DxcsMzMrBRcsMzMrBRcsMzMrBRcsMzMrBRcssw6giue0tWMen1F+7pvZ+5ELlll5fAZwwbL3LRcss47TTdLvVPF0dr33qfB9AJSeDP9Ebr9a0kDSU1++nx/ds+PyFmTWFfmLw2YdIBecKaQn/z8i6VrSExB+DHwvIsZIOhlYOyKOkvQS6Qn0CyWtGxGvSToReDMiflXQapgVykdYZh1nWkQ8krsnkJ5r1/qp8M1P3Z4MXClpP9Kz9Mze91ywzDpO66dfL+9ZdV8mPWR2G+Ch5ofRmr2fuWCZFafqU+HzQ1AHRMTdwP+w7Cn5b5B+Bsbsfcmf2syKNQq4IP8sw1TSE/e7AX9U+iFJAWfna1h/Bq6XNIJ03auWn2cxKz3fdGFmZqXgU4JmZlYKLlhmZlYKLlhmZlYKLlhmZlYKLlhmZlYKLlhmZlYKLlhmZlYKLlhmZlYK/x9Tp9kYPkOHxAAAAABJRU5ErkJggg==\n",
      "text/plain": [
       "<Figure size 432x288 with 1 Axes>"
      ]
     },
     "metadata": {
      "needs_background": "light"
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "log_df['body_bytes_sent'] = log_df['body_bytes_sent'].astype(int)\n",
    "sns.boxenplot(x='host', y='body_bytes_sent', data=log_df);"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "SLS",
   "language": "python",
   "name": "sls"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.0"
  },
  "toc": {
   "base_numbering": 1.0,
   "nav_menu": {},
   "number_sections": true,
   "sideBar": true,
   "skip_h1_title": false,
   "title_cell": "Table of Contents",
   "title_sidebar": "Contents",
   "toc_cell": false,
   "toc_position": {},
   "toc_section_display": true,
   "toc_window_display": false
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}
